Overview

overview

10

Static

static

3

D5848832B0...00.exe

windows10-2004-x64

10

D5848832B0...00.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    88s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09/08/2025, 14:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    D5848832B09FD4445D2E2A00EA9F2500.exe
  • Size 2.2MB
  • Sample250809-ryctrayvbv
  • SHA256 370d9f85a3cd1dfc33df7de053a269d9d3c62b84e0f939180e3fbb7e8e12b574
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeydeerstealergcleanerlummaquasarredlinerhadamanthyssectopratvidarcheatfbf543office04defense_evasiondiscoveryexecutioninfostealerloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • lumma

C2

  • https://mocadia.com/iuew

  • https://mastwin.in/qsaz/api

  • https://precisionbiomeds.com/ikg

  • https://physicianusepeptides.com/opu

  • https://vishneviyjazz.ru/neco/api

  • https://htsfhtdrjbyy1bgxbv.cfd/vcd

  • https://xurekodip.com/qpdl

  • https://utvp1.net/zkaj

  • https://orienderi.com/xori

  • https://invertdbdi.top/xjit

  • https://ordinarniyvrach.ru/xiur/api

  • https://yamakrug.ru/lzka/api

  • https://yrokistorii.ru/uqya/api

  • https://stolewnica.ru/xjuf/api

  • https://visokiywkaf.ru/mmtn/api

  • https://kletkamozga.ru/iwyq/api

  • https://t.me/yahherhay

  • https://syntrva.forum/toiu/api

  • https://vaganetka.ru/opza/api

Attributes
  • build_id

    7424ae8ede7f05ff6c068fda1afff37361a6522b

Extracted

Family

  • amadey

Version

  • 5.55

Botnet

  • fbf543

C2

  • http://94.154.35.25

Attributes
  • install_dir

    96a319e745

  • install_file

    Srxelqcif.exe

  • strings_key

    f8bfac017914b836f3106c5bcd0878fe

  • url_paths

    /di9ku38f/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • cheat

C2

  • 156.234.7.20:56491

Extracted

Family

  • gcleaner

C2

  • 185.156.73.98

  • 45.91.200.135

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Office04

C2

  • 45.32.188.16:4782

Mutex

  • a1dd0451-550a-423e-9d0c-2c5d428006aa

Attributes
  • encryption_key

    5A02637EA4935A85024FB89EB09C832017BFE48A

  • install_name

    Client.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer
  • Deerstealer family
    deerstealer
  • Detect Vidar Stealer 26 IoCs
    stealer
  • Detects DeerStealer 11 IoCs
    stealer
  • Detects Rhadamanthys Payload 1 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Redline family
    redline
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Rhadamanthys family
    rhadamanthys
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs
  • Sectoprat family
    sectoprat
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    defense_evasion
  • Downloads MZ/PE file 15 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 40 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 9 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Windows directory 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 33 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3328
      • C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe
        "C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1000
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /setowner "SYSTEM"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3296
          • C:\Windows\SysWOW64\icacls.exe
            icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /setowner "SYSTEM"
            4⤵
            • Modifies file permissions
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:5888
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4476
          • C:\Windows\SysWOW64\icacls.exe
            icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
            4⤵
            • Modifies file permissions
            • System Location Discovery: System Language Discovery
            PID:5884
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /remove:d Everyone Administrators
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2648
          • C:\Windows\SysWOW64\icacls.exe
            icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /remove:d Everyone Administrators
            4⤵
            • Modifies file permissions
            • System Location Discovery: System Language Discovery
            PID:1976
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /setowner "SYSTEM"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3256
          • C:\Windows\SysWOW64\icacls.exe
            icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /setowner "SYSTEM"
            4⤵
            • Modifies file permissions
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:5232
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5292
          • C:\Windows\SysWOW64\icacls.exe
            icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
            4⤵
            • Modifies file permissions
            • System Location Discovery: System Language Discovery
            PID:5072
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /remove:d Everyone Administrators
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4360
          • C:\Windows\SysWOW64\icacls.exe
            icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /remove:d Everyone Administrators
            4⤵
            • Modifies file permissions
            • System Location Discovery: System Language Discovery
            PID:5496
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe" -StartupType Automatic"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5568
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe" -StartupType Automatic"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6112
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c net start "DownloaderService"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5152
          • C:\Windows\SysWOW64\net.exe
            net start "DownloaderService"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3520
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start "DownloaderService"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4868
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c schtasks /create /tn "P6CeWpGv" /xml "C:\Users\Admin\AppData\Local\Temp\P6CeWpGv.xml" /f
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2160
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "P6CeWpGv" /xml "C:\Users\Admin\AppData\Local\Temp\P6CeWpGv.xml" /f
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:5996
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c start "" "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2564
          • C:\Users\Admin\Desktop\2jq4GUd2.sBm5q
            "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q"
            4⤵
            • Downloads MZ/PE file
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2804
            • C:\Users\Admin\AppData\Local\Temp\10288540101\1wbVZkk.exe
              "C:\Users\Admin\AppData\Local\Temp\10288540101\1wbVZkk.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2084
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c cmd < Advisory.rtf
                6⤵
                • System Location Discovery: System Language Discovery
                PID:400
                • C:\Windows\SysWOW64\cmd.exe
                  cmd
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1240
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5512
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set SVZBPwRgtdGoTCVYDpZvyImMuxoYcfcZgYnUx=AutoIt3.exe & Set GqJAEfpKsvEQZkhCVVlug=.a3x & Set SJaHEIhOIRsgEIoxPeFIO=300
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:5508
                  • C:\Windows\SysWOW64\extrac32.exe
                    extrac32 /Y Bmw.rtf *.*
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:5556
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /V "OPENS" Biographies
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:5520
                  • C:\Users\Admin\AppData\Local\Temp\649113\Housing.pif
                    Housing.pif x
                    8⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:3184
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 820
                      9⤵
                      • Program crash
                      PID:4240
                  • C:\Windows\SysWOW64\waitfor.exe
                    waitfor /T 5 SJaHEIhOIRsgEIoxPeFIO
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2092
            • C:\Users\Admin\AppData\Local\Temp\10315300101\bLGj4G0.exe
              "C:\Users\Admin\AppData\Local\Temp\10315300101\bLGj4G0.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:872
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:660
            • C:\Users\Admin\AppData\Local\Temp\10342500101\r6JiyOq.exe
              "C:\Users\Admin\AppData\Local\Temp\10342500101\r6JiyOq.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1576
            • C:\Users\Admin\AppData\Local\Temp\10357140101\QL2M7cr.exe
              "C:\Users\Admin\AppData\Local\Temp\10357140101\QL2M7cr.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1060
            • C:\Users\Admin\AppData\Local\Temp\10359300101\77071deb0f.exe
              "C:\Users\Admin\AppData\Local\Temp\10359300101\77071deb0f.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:4580
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                6⤵
                  PID:4872
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4832
              • C:\Users\Admin\AppData\Local\Temp\10365170101\L6qQkwT.exe
                "C:\Users\Admin\AppData\Local\Temp\10365170101\L6qQkwT.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5296
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 1800
                  6⤵
                  • Program crash
                  PID:572
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 1788
                  6⤵
                  • Program crash
                  PID:1956
              • C:\Users\Admin\AppData\Local\Temp\10366460101\AeeL4rc.exe
                "C:\Users\Admin\AppData\Local\Temp\10366460101\AeeL4rc.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4592
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4124
              • C:\Users\Admin\AppData\Local\Temp\10367590101\IfKyM0a.exe
                "C:\Users\Admin\AppData\Local\Temp\10367590101\IfKyM0a.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1096
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                  6⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1828
                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:3752
                  • C:\Windows\SYSTEM32\schtasks.exe
                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:8
              • C:\Users\Admin\AppData\Local\Temp\10368680101\OtoCzBd.exe
                "C:\Users\Admin\AppData\Local\Temp\10368680101\OtoCzBd.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:460
                • C:\Windows\HelpPane.exe
                  C:\\Windows\\HelpPane.exe
                  6⤵
                    PID:4004
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                      7⤵
                      • Drops file in Windows directory
                      • Enumerates system info in registry
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:3260
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff925bddcf8,0x7ff925bddd04,0x7ff925bddd10
                        8⤵
                          PID:1236
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1424,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2472 /prefetch:11
                          8⤵
                            PID:3588
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2432,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2296 /prefetch:2
                            8⤵
                              PID:4904
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=1920,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2684 /prefetch:13
                              8⤵
                                PID:3536
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3152 /prefetch:1
                                8⤵
                                  PID:1032
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3096,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3172 /prefetch:1
                                  8⤵
                                    PID:3744
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4176,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3776 /prefetch:9
                                    8⤵
                                      PID:3996
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4608,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4680 /prefetch:1
                                      8⤵
                                        PID:4232
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5268,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5320 /prefetch:14
                                        8⤵
                                          PID:4052
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5860,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5868 /prefetch:14
                                          8⤵
                                            PID:4636
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5960,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5308 /prefetch:14
                                            8⤵
                                              PID:4220
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5316,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6064 /prefetch:14
                                              8⤵
                                                PID:1244
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5404,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6100 /prefetch:14
                                                8⤵
                                                  PID:3240
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6088,i,15923060061216262447,12416448043331050527,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4164 /prefetch:14
                                                  8⤵
                                                    PID:5380
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                  7⤵
                                                    PID:1204
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ff8ff28f208,0x7ff8ff28f214,0x7ff8ff28f220
                                                      8⤵
                                                        PID:1020
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1820,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:11
                                                        8⤵
                                                          PID:1468
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2732,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:2
                                                          8⤵
                                                            PID:744
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2100,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
                                                            8⤵
                                                              PID:5160
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3376,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
                                                              8⤵
                                                                PID:2952
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3392,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
                                                                8⤵
                                                                  PID:5280
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5256,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
                                                                  8⤵
                                                                    PID:2332
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5252,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
                                                                    8⤵
                                                                      PID:4336
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5236,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
                                                                      8⤵
                                                                        PID:5848
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5428,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                                                                        8⤵
                                                                          PID:2860
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
                                                                            cookie_exporter.exe --cookie-json=1128
                                                                            9⤵
                                                                              PID:6076
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5456,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
                                                                            8⤵
                                                                              PID:4260
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5456,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
                                                                              8⤵
                                                                                PID:5184
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2252,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
                                                                                8⤵
                                                                                  PID:644
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=868,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
                                                                                  8⤵
                                                                                    PID:4740
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6176,i,9374439761519165192,8412935740915785037,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
                                                                                    8⤵
                                                                                      PID:3344
                                                                              • C:\Users\Admin\AppData\Local\Temp\10370560101\xQvtpl8.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\10370560101\xQvtpl8.exe"
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                PID:5068
                                                                                • C:\Windows\HelpPane.exe
                                                                                  C:\Windows\HelpPane.exe
                                                                                  6⤵
                                                                                  • Checks processor information in registry
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:5128
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                    7⤵
                                                                                    • Drops file in Windows directory
                                                                                    • Enumerates system info in registry
                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    PID:5696
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff925bddcf8,0x7ff925bddd04,0x7ff925bddd10
                                                                                      8⤵
                                                                                        PID:5700
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1960,i,6576301795872082385,14682566326399697725,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1956 /prefetch:2
                                                                                        8⤵
                                                                                          PID:1128
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2236,i,6576301795872082385,14682566326399697725,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2244 /prefetch:11
                                                                                          8⤵
                                                                                            PID:5788
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2368,i,6576301795872082385,14682566326399697725,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2728 /prefetch:13
                                                                                            8⤵
                                                                                              PID:5520
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3208,i,6576301795872082385,14682566326399697725,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3256 /prefetch:1
                                                                                              8⤵
                                                                                                PID:4716
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,6576301795872082385,14682566326399697725,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3280 /prefetch:1
                                                                                                8⤵
                                                                                                  PID:1956
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4208,i,6576301795872082385,14682566326399697725,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3800 /prefetch:9
                                                                                                  8⤵
                                                                                                    PID:3124
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4356,i,6576301795872082385,14682566326399697725,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4688 /prefetch:1
                                                                                                    8⤵
                                                                                                      PID:3336
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                    7⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Enumerates system info in registry
                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:6000
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ff8fddaf208,0x7ff8fddaf214,0x7ff8fddaf220
                                                                                                      8⤵
                                                                                                        PID:4100
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1728,i,5583682953119794573,6128557503503115633,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
                                                                                                        8⤵
                                                                                                          PID:1924
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2648,i,5583682953119794573,6128557503503115633,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
                                                                                                          8⤵
                                                                                                            PID:2680
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2144,i,5583682953119794573,6128557503503115633,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
                                                                                                            8⤵
                                                                                                              PID:1672
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3400,i,5583682953119794573,6128557503503115633,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
                                                                                                              8⤵
                                                                                                                PID:5104
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3408,i,5583682953119794573,6128557503503115633,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
                                                                                                                8⤵
                                                                                                                  PID:3808
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\lfkny" & exit
                                                                                                                7⤵
                                                                                                                  PID:3304
                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                    timeout /t 11
                                                                                                                    8⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:1936
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10373150101\a349170bba.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10373150101\a349170bba.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2288
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                6⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4560
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10373160101\9a33548f02.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10373160101\9a33548f02.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              PID:5100
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:3640
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10373170101\OtoCzBd.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10373170101\OtoCzBd.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:5364
                                                                                                              • C:\Windows\HelpPane.exe
                                                                                                                C:\\Windows\\HelpPane.exe
                                                                                                                6⤵
                                                                                                                  PID:5520
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10373180101\1wbVZkk.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10373180101\1wbVZkk.exe"
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:5624
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd.exe /c cmd < Advisory.rtf
                                                                                                                  6⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:6076
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    cmd
                                                                                                                    7⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2236
                                                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                      tasklist
                                                                                                                      8⤵
                                                                                                                      • Enumerates processes with tasklist
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2924
                                                                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                                                                      findstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set SVZBPwRgtdGoTCVYDpZvyImMuxoYcfcZgYnUx=AutoIt3.exe & Set GqJAEfpKsvEQZkhCVVlug=.a3x & Set SJaHEIhOIRsgEIoxPeFIO=300
                                                                                                                      8⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:844
                                                                                                                    • C:\Windows\SysWOW64\extrac32.exe
                                                                                                                      extrac32 /Y Bmw.rtf *.*
                                                                                                                      8⤵
                                                                                                                        PID:672
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\649113\Housing.pif
                                                                                                                        Housing.pif x
                                                                                                                        8⤵
                                                                                                                          PID:3676
                                                                                                                        • C:\Windows\SysWOW64\waitfor.exe
                                                                                                                          waitfor /T 5 SJaHEIhOIRsgEIoxPeFIO
                                                                                                                          8⤵
                                                                                                                            PID:3344
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10373190101\RenT7Wg.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\10373190101\RenT7Wg.exe"
                                                                                                                      5⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:5496
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                        6⤵
                                                                                                                          PID:1540
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                          6⤵
                                                                                                                            PID:2176
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                            6⤵
                                                                                                                              PID:5004
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10373200101\xQvtpl8.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10373200101\xQvtpl8.exe"
                                                                                                                            5⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            PID:1860
                                                                                                                            • C:\Windows\HelpPane.exe
                                                                                                                              C:\Windows\HelpPane.exe
                                                                                                                              6⤵
                                                                                                                                PID:3156
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                  7⤵
                                                                                                                                    PID:2280
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff925bddcf8,0x7ff925bddd04,0x7ff925bddd10
                                                                                                                                      8⤵
                                                                                                                                        PID:5496
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                      7⤵
                                                                                                                                        PID:688
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff925bddcf8,0x7ff925bddd04,0x7ff925bddd10
                                                                                                                                          8⤵
                                                                                                                                            PID:5492
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                          7⤵
                                                                                                                                            PID:3836
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff925bddcf8,0x7ff925bddd04,0x7ff925bddd10
                                                                                                                                              8⤵
                                                                                                                                                PID:5380
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1724,i,8110542878954093257,5179984110953160298,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
                                                                                                                                                8⤵
                                                                                                                                                  PID:5328
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2584,i,8110542878954093257,5179984110953160298,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
                                                                                                                                                  8⤵
                                                                                                                                                    PID:5252
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2000,i,8110542878954093257,5179984110953160298,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
                                                                                                                                                    8⤵
                                                                                                                                                      PID:5076
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2972,i,8110542878954093257,5179984110953160298,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:1
                                                                                                                                                      8⤵
                                                                                                                                                        PID:5068
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2980,i,8110542878954093257,5179984110953160298,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:1
                                                                                                                                                        8⤵
                                                                                                                                                          PID:1912
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,8110542878954093257,5179984110953160298,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
                                                                                                                                                          8⤵
                                                                                                                                                            PID:3336
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                          7⤵
                                                                                                                                                            PID:2160
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                            7⤵
                                                                                                                                                              PID:2000
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                              7⤵
                                                                                                                                                                PID:432
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:2712
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:6116
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:3792
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x320,0x7ff8ffa6f208,0x7ff8ffa6f214,0x7ff8ffa6f220
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:1928
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1768,i,13261470380368130256,8229700127276924928,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:11
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:1688
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2624,i,13261470380368130256,8229700127276924928,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:4904
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2056,i,13261470380368130256,8229700127276924928,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:5268
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3424,i,13261470380368130256,8229700127276924928,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
                                                                                                                                                                                8⤵
                                                                                                                                                                                  PID:1856
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3432,i,13261470380368130256,8229700127276924928,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:2612
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10373210101\G4gtDRI.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10373210101\G4gtDRI.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4124
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:2076
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10373220101\L6qQkwT.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10373220101\L6qQkwT.exe"
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:2860
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1844
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:1560
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 632
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:4804
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\10373230101\IfKyM0a.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10373230101\IfKyM0a.exe"
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:5904
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10373240101\QL2M7cr.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10373240101\QL2M7cr.exe"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:5332
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10373250101\r6JiyOq.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\10373250101\r6JiyOq.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:1680
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10373260101\v9d9d.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10373260101\v9d9d.exe"
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:2712
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10373260101\v9d9d.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10373260101\v9d9d.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:2756
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:3060
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff925bddcf8,0x7ff925bddd04,0x7ff925bddd10
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                      PID:968
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2480,i,17251231865106451819,680222836835054627,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:2324
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1352,i,17251231865106451819,680222836835054627,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                          PID:3120
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=1936,i,17251231865106451819,680222836835054627,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:13
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                            PID:1196
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,17251231865106451819,680222836835054627,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,17251231865106451819,680222836835054627,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                PID:2372
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4480,i,17251231865106451819,680222836835054627,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:1720
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:4308
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ff90e78f208,0x7ff90e78f214,0x7ff90e78f220
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                        PID:5036
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1772,i,13111448774280321542,6687819996674416868,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                          PID:3956
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2476,i,13111448774280321542,6687819996674416868,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                            PID:3120
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2080,i,13111448774280321542,6687819996674416868,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:13
                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,13111448774280321542,6687819996674416868,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                PID:3588
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,13111448774280321542,6687819996674416868,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                  PID:2776
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10373270101\AeeL4rc.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\10373270101\AeeL4rc.exe"
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:1776
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:4708
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10373280101\OTIWCUm.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10373280101\OTIWCUm.exe"
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:772
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xszmuvlb.u2k"
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                          PID:4704
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xszmuvlb.u2k /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\xszmuvlb.u2k\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\xszmuvlb.u2k --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff925bddcf8,0x7ff925bddd04,0x7ff925bddd10
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                              PID:1332
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xszmuvlb.u2k" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2036,i,8799404736246903770,8762446598433945558,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                PID:1388
                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xszmuvlb.u2k" --field-trial-handle=1868,i,8799404736246903770,8762446598433945558,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                  PID:6084
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ch2gmf5l.tlg"
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                  PID:3516
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ch2gmf5l.tlg /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ch2gmf5l.tlg\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ff8ffa6f208,0x7ff8ffa6f214,0x7ff8ffa6f220
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                      PID:5084
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10373290101\bLGj4G0.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10373290101\bLGj4G0.exe"
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:536
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:2652
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10373300101\22179f3ba4.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10373300101\22179f3ba4.exe"
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:3060
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Oq7wPMe.bat" "
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:5212
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
                                                                                                                                                                                                                                                            nircmd win min process "cmd.exe"
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\chcp.com
                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                PID:3916
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                reg query "HKU\S-1-5-19"
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                  PID:2288
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                    PID:5144
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
                                                                                                                                                                                                                                                                    NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\Oq7wPMe.bat" any_word
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:5556
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\mode.com
                                                                                                                                                                                                                                                                      Mode 79,49
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ver
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                          PID:3976
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                            PID:1216
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                                                                                            find /i "0x0"
                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                              PID:2980
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c tasklist
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                PID:3972
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                                                                  tasklist
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                  PID:4904
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                  PID:1856
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10373310101\83c71c0650.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10373310101\83c71c0650.exe"
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:3512
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            "cmd.exe" /c start "" "C:\Users\Admin\Desktop\on6jPp6S.exe"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1016
                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\on6jPp6S.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\on6jPp6S.exe"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KangarooScript.url" & echo URL="C:\Users\Admin\AppData\Local\ScriptMaster Solutions\KangarooScript.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KangarooScript.url" & exit
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:564
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                        PID:3500
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          "cmd.exe" /c icacls "7zj3EZ6q.exe" /setowner "SYSTEM"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:5196
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                            icacls "7zj3EZ6q.exe" /setowner "SYSTEM"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                            PID:4784
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          "cmd.exe" /c icacls "7zj3EZ6q.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:2980
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                            icacls "7zj3EZ6q.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1036
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          "cmd.exe" /c icacls "7zj3EZ6q.exe" /remove:d Everyone Administrators
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:2552
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                            icacls "7zj3EZ6q.exe" /remove:d Everyone Administrators
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:4348
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:1088
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 564
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:5328
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2004
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:5580
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:1004
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:4800
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3908
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 540
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:3992
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2080
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:4656
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2988
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:3664
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3364
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:4428
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:948
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:3264
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:5504
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:2092
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:5844
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4600
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:4508
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2820
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:3996
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4584
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:4532
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:5308
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:3100
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:1412
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:1576
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:1816
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:2164
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:5140
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 536
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:5784
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1904
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 536
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                              PID:1040
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                            "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:2852
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 536
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:1928
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                              "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:2608
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 536
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:2516
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                                "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 536
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                    PID:3940
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                                  "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:384
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 536
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:2884
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                                    "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:4724
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 536
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                        PID:5792
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                                      "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:5996
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 536
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:5108
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                                        "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:3612
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 536
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                            PID:3128
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                                          "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:5640
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 536
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                              PID:5352
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                                            "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1776
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 536
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:5852
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\7zj3EZ6q.exe
                                                                                                                                                                                                                                                                                              "7zj3EZ6q.exe"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:5704
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 536
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1088 -ip 1088
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:3288
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2004 -ip 2004
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:3552
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1004 -ip 1004
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:3568
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3908 -ip 3908
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:4796
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 2080 -ip 2080
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:2672
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2988 -ip 2988
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:460
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3364 -ip 3364
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:4416
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5296 -ip 5296
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:3452
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5296 -ip 5296
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:4924
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 948 -ip 948
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5504 -ip 5504
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:1112
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5844 -ip 5844
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:4500
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4600 -ip 4600
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:5168
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2820 -ip 2820
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:4956
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4584 -ip 4584
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:5372
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5308 -ip 5308
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:1680
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1412 -ip 1412
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:3700
                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:5692
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:1244
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1816 -ip 1816
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:1060
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:5480
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:1300
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5140 -ip 5140
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 1904 -ip 1904
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:6132
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2860 -ip 2860
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3852
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2860 -ip 2860
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:764
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2852 -ip 2852
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3316
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3116
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2608 -ip 2608
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3812
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:332
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3184 -ip 3184
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:772
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3340 -ip 3340
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1104
                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3108
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 384 -ip 384
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1688
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4724 -ip 4724
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5856
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5996 -ip 5996
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5212
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          cmd.exe /c start "" "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q"
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\2jq4GUd2.sBm5q
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q"
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5104
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3612 -ip 3612
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:248
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5640 -ip 5640
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:948
                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3096
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5328
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1776 -ip 1776
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5092
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3488
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5716
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5704 -ip 5704
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4980
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5580
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1676

                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                                                                                                                                                                      PowerShell

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1059.001

                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                      File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1222

                                                                                                                                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1555

                                                                                                                                                                                                                                                                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1555.003

                                                                                                                                                                                                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                                                                                                                      Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1217

                                                                                                                                                                                                                                                                                                                                                                                                      Process Discovery

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1057

                                                                                                                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                      7
                                                                                                                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                      79rq1v
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\16890\79rq1v
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 288KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ca1a8db48da3643324fb8c93e68c8a3552dcf992a3cd79755469d878f57503d5
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      cjmy58
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\16890\cjmy58
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a0e6f63c845871fe728536f99adbc3cf30d91e136de4692a18fe8d14fd07176c
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      nop8qi
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\16890\nop8qi
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 58d535170885a59edf503d0c52ed067f1afa514172f94266b4b2e83e56666f4b
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      ozuaim
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\ProgramData\1n7qq\ozuaim
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 160KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ecc8d7540d26e3c2c43589c761e94638fc5096af874d7df216e833b9599c673a
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 40B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d8c1b5f445c912772931368a35e7b17980c309ce8b727a6ef38e5d112aead667
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      BrowsingTopicsState
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 414B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6161db3df0de6169bcf219034a10a90dbf4823340f038ea72a5a42e1ddce1cb0
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0ed0aa520b149dd9bb158d5e0f151c93f083b68d5958be6678ae7e1a8262a0a1
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 39f34c81c1cad92d0c9e04c34ab5cd70ba6957d5334fe5d7b874ccc0dc87a5c1
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Last Version
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 13B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 84KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2cf04f57e8db93e7b0bd774a6a61c54527e497fc3e3cf3a54b8298e43dba13ad
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 83KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 218f4d9cbe1bb9f8b43c00f93ddb9b858e4e1d400c558c6306f358b318b5f98f
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 300d2604f5bac7fa05d33d5757e3fd90f519bb2dc50312c5fd6a07af98064527
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 9d3de770b0fc9490e2c383cd4a2fe257c5a5bcb8f19422377ed9d26a5d420d8c
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ed0d1cb814e435bc7f3b7cdfa188e243402082d1d8bb1eb30961fdfaec850730
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 35ec5c0358eed32fcfb79c6c47c7d3f1aa92dc3a53e4facbf184bc038d8eebc0
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 fa0155bd3f221d417174eb05f9f2ace3b8d2481de114fda7996342e005612dc4
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      7969de3a-477a-4ea3-8a73-22ad43996f7b.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7969de3a-477a-4ea3-8a73-22ad43996f7b.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      CURRENT
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 16B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      HubApps
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 108KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Network Persistent State
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4e16fcad5eab78d8165163becba4c40cc521f056e9b598a62bce1edf64e3c0ed
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 40B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 18KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5af43b22a3e1143e34f9b501f118274bbeae93689a1d01a2d4f82eed296652f6
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 28e859aba687214b06b8532f0023c29902bd074242840379c55ba560f30226f1
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 37KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 9660d7998fd385f90607bbd6e0c5651e8b2890c8ebbb810561cda23713c2299c
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 37KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a9a3dddf59f42eda6599d72df9a1af786b6b9c874cd879f9fc52c4d030c92e66
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1caa39c6-193f-4cec-86aa-23d6778013d4\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 72B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a4c34791c9d6e6b5b356b4939c81bbf6d3ce512072ac02b4c86caad00a06a469
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1caa39c6-193f-4cec-86aa-23d6778013d4\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 72B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 282a1fa326a6d4f30d5dadc7f69951d475552fa8d99f55c32bb1084f7c882be0
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\294ca650-7b15-4d3c-b517-fd48199a85bc\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f81e288439d98fcde3c0ac5ca96be1a6e5447b8d4114513a8b52c1362e35f4d1
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      the-real-index~RFe58eb55.TMP
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\294ca650-7b15-4d3c-b517-fd48199a85bc\index-dir\the-real-index~RFe58eb55.TMP
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0be9eab6ec6ddf8247f1714b1a82c3315eca79870833ad254cd936ee12c6162e
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 72B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a5534d441e44d3c349d4ef155c545a9c329d3c8f766168a59a7011528c6ac0a5
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      the-real-index~RFe595819.TMP
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595819.TMP
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 48B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c6420babebee26a1de71ed28b4c03037de7d3d247fda39fb1b367e20279854a9
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 41B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 23KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 50714de4472a72c6402b50775f08bc8e80b9f1b0a9ca199707ae052316d09058
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6076c5f1bf225de25579347eaa3aba3ed8e185e4fdd6eed025d4a1b95ffd1d0f
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 22c629a392f6ea7cadb77b6e6ee00fde3735e276ea0fd84f8f8ec521d5674d03
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 38KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5fd032346acb335d0b67175366d32a86962ef807b66e3b97155c28692540605c
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 38KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 473f208c0b2b3a3d8c7a830615818d7ebe7fa484faca399381abbe10a8c4b1e4
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      service[1].htm
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J119QJ6F\service[1].htm
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      1wbVZkk.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10288540101\1wbVZkk.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.5MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 39f9313b61a51d858cd6c87914ab9750133d81901595ee83d8f722bf21bf16eb
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      bLGj4G0.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10315300101\bLGj4G0.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2644f133ad541942e868ba65f4182adc6937ec9546ba1b63b092369cc47529a4
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      r6JiyOq.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10342500101\r6JiyOq.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c37d5eb23cc9b0e8d4ae259326dc16259df6fcfdb2c29faa43efc550301fafdf
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      QL2M7cr.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10357140101\QL2M7cr.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 95KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f8adb7a5f15c39d7df9be8921dea850cccad2e6f3881b8ec17a2527e5ab0ff3e
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      77071deb0f.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10359300101\77071deb0f.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6a598128fde3a08fd93fc7a3378a751d07002deaae73b051a918744e63895555
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      L6qQkwT.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10365170101\L6qQkwT.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3.0MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 daa1e8c37f131efe55995260e3772db5bfe8d3d5c5c96d2adc7a55492aab0bae
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      AeeL4rc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10366460101\AeeL4rc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 703f17f45bd635fc937f41e53bb5de69fb506dbafba444a3bfc7858542458ff4
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      IfKyM0a.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10367590101\IfKyM0a.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e2f723fe52e61403dc1f2c664f20697de255aa51db780cc6353bf0eeeb386dfc
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      OtoCzBd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10368680101\OtoCzBd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3.7MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f9e00927a08ae4a41d4ab4c48f01d8cb457e03980cb15e1d6a5e9b8b1c92c4f0
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      xQvtpl8.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10370560101\xQvtpl8.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 bc1800cb2b769decc9eadc0cc2389b017c0d4cc7cae95cb786c0d1dc9edc712a
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      a349170bba.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10373150101\a349170bba.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3.3MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 afe7cc64a3b16e6510380d14d7d6a9888729f533a851ea56dcb3326bc409690e
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      RenT7Wg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10373190101\RenT7Wg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ac2ab493b001c522defd69992db7173a5d696fd29e56f17b4f606da041a3ac3e
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      G4gtDRI.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10373210101\G4gtDRI.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e08a7ed1e201f5564f8ec101f6f5faff7b93f3d72e340e707e0d4bead84ebe2b
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      v9d9d.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10373260101\v9d9d.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 aa49684e48cdc3a3b706973c0c55fd1a2be03aa0337e15810db20f6a08c127a9
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      OTIWCUm.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10373280101\OTIWCUm.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7c6dae3a821c09007f94cfc06f504eeea810efffff714db6b7a770f4cb34df4b
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      22179f3ba4.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10373300101\22179f3ba4.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 471d7771aab3a1a52e059e57d17aef1ed64893782a0b2efb91101bafa9ff41ed
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      83c71c0650.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\10373310101\83c71c0650.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0d24214b9cc9d044faca634bc94c3eabc0d7910ecfff36c485834378966469f9
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Housing.pif
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\649113\Housing.pif
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 957KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3ec9740bedc683021cc3e94e4a33b3a9d3d6f9b9e96b1f04cc6534f551dd58c1
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      x
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\649113\x
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 986KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 40868b3d75d664ffdaaf778f443e4b903917624a7a27d12486801645609667da
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Advisory.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Advisory.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 25KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4053b99a054a086a4027fc41cc610c1e855f94cf45fc7d6e4c990731f794e7ea
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Alien
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Alien
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 114KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8ffd8bd34e9cb87153663cb33bbc5893ae17c04efe024566ab9067d1dfe7e8c6
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Another.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Another.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 148KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 71547f6b151b6249703911b05f4c8d018d71fb5a781493b9f104739d93e964b6
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Biographies
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Biographies
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2af2770e1fb75014029f2f64c508cd47482f1754d28517c69007f54d33da9e5b
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Bmw.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Bmw.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 495KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 817320dead9f33b9bb0d2c81a369a29b0b034c853d973037d61e8a66bcb9e7e5
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Cardiovascular
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Cardiovascular
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 56KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 555bc7b38b6369f646ff437bd99a60de042a73076340b0103a50d77de7b8dc6b
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Checkout
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Checkout
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 89KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 36d1300c6d19be849b24e79173262629887ac26040e84e26b39762cb09bf056f
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Grab.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Grab.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 264KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 09f69a3fb05f421e6694e0063ed034ef466fb80d7d3af7473be5b0efd32a4ad0
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Greg
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Greg
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 70KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 58c45122a6a4fd2e2fedfb3bbc78c3558f863a3f0ce44b68bb6834def225db72
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Integrate.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Integrate.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 299KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0ae5b38ee72d45bd964e35c833ca9a05cfae5b752956a7394b827e2e8ca4727a
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Kong.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Kong.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 154KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8d09f90811c956de08aac103cc2436270ab970aec76058f201841ae9053ac05c
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Nature
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Nature
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 136KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 278c58032cff5be7fba7c2dba1cfe08ad962ab08ddaf51556af956ce1338ee77
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      P6CeWpGv.xml
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\P6CeWpGv.xml
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b70c3eabc13814f4e57ee0f0d2e0b49bcf4a8cbebede7cd0cba7c8fe51cd47fa
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Peoples
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Peoples
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 53KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e924bfe46df63b3330511dca298b41cc493104e8feeaf4c8e4e2c972b54ca308
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Providers.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Providers.rtf
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 121KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 03bb9c093cc85e190a463965d7b9546567598780db7285ce67dd512abfdff106
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Ran
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Ran
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 55KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ee17bff80aac15c40039574c75b04bb89daaab96ff4475850c7c2640483c7f26
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Shock
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Shock
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 105KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d8d3ee5efaf4909486ddae6bb7e2f8626c57cc8032e037d4973d69a887176bdd
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Signal
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Signal
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 52KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 31503d3282cc12cbd61882bd90e949c372405a0cdd72ce3b9b78d1cec0a1efe6
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Speaker
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Speaker
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 91KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 63f9e4a206b0e1f8039ee7308778bee29f7d9deeee3cd1567fed64893550aba4
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      Stomach
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Stomach
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 134KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 53b90f72876fc182d5dd2a85143adb3fbd378e7d29b5ab6bd46717bd47cd8b18
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      __PSScriptPolicyTest_twgjzink.g5u.ps1
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_twgjzink.g5u.ps1
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ch2gmf5l.tlg\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 55ff93a5d3d79cb8f147fda34da66c91ec8f82e2c5890ee552cc613e4a1d5232
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      nsExec.dll
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsq93D6.tmp\nsExec.dll
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      da1b1254-1f48-4997-b754-8474ec390848.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3260_1019625960\da1b1254-1f48-4997-b754-8474ec390848.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 158KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a09c3dd83a50f1a9e3d59e8dfc347717e86fae2434f239637afd4037511b26d2
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      svchost015.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4e04e2fb20a9c6846b5d693ea67098214f77737f4f1f3df5f0c78594650e7f71
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmp1AA9.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp1AA9.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 130KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d2ba06a42373e99acdc0ea78fbe0448a32de70ec4d1911f35f03e81905b87d68
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmp1B28.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp1B28.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 228KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 47776f3910457d45a44061f52b676799e47b212c82142c8ab97dc7961e35f985
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmp25B7.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp25B7.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 769KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ec2e61a846ac3fa0cb53cd8f4bba35d5b35152e22ffdb39b58cc2702efacef16
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmp265A.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp265A.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f55999a18f03cb40a116b3762359585ac065fe68939358a8b9f490c5f70c3a8e
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmp266D.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp266D.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 727KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 06e597d3e4dddd53d6ed328c03161a85f42c973991f1b4a1391da722ee858424
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmp2670.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp2670.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 13KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 637e35db1a9cb6a9d3af0b484d65a182f7fd4ed9fdc44eb754b0ae651275d6af
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmp2671.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp2671.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 630KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 466d5b93155e98f0085c0ef33ffa0bc0edbe4d81b6b1e30d4703c2b919d32dd5
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmp2672.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp2672.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1b4c9e72498f0e5fe54f9a8a7f577d88f2fffebeb6677e5ee12a3c8b1b481098
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmp2673.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp2673.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ca58ce66346bd4752696028384b49498a0c8426aee78bfbeadb7ede05581c1d2
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmp2678.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp2678.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1.4MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c65f729451ddd660da0591c49f9899b5ecca2164a2a33316ce7ac90a0d9e9e10
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmpE9A9.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpE9A9.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6e1bf340a55a1c7283c39a6f1d8961fd44961924242f3edc93e1433834c3affd
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmpE9C0.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpE9C0.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 438KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 db283896fda2ca40ea2b321050fed8502e5eefe478b4f6b5d20471d42173da03
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmpEA2C.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpEA2C.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 29f4678fbb11626964b3279238fe834754fdb29971b7b38d9516c9281ef98e6e
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmpEA2D.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpEA2D.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 9c0a1a26a13229f52a98d858b151678bb8eec7f6945100e590ff008c067ff427
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmpEA50.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpEA50.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmpEA65.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpEA65.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 130KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1e96f8ce010d338899e9a7ad20bcac1804f476d3e001a85a708c3a5b6e2f7360
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmpEA81.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpEA81.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 56KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 ce41f2a3255df2099ae8eea9364bd28c6fd6a56c8ca3290bd274944d16d9e6bf
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmpEA97.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpEA97.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 228KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 257947aba31142bab41ca56915c2ef843c2a156c527dee5d1a07e1224e380aed
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      tmpEAB2.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpEAB2.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 96KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      2jq4GUd2.sBm5q
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Desktop\2jq4GUd2.sBm5q
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 416KB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      on6jPp6S.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Desktop\on6jPp6S.exe
                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2.9MB
                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d9b5dc06fbc8984af61289cd39f2ae43080613d6849bf74d0694939ad1b56161
                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/660-749-0x00000000006B0000-0x00000000006DF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/660-234-0x00000000006B0000-0x00000000006DF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/660-593-0x0000000010000000-0x000000001001C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/660-611-0x00000000006B0000-0x00000000006DF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/772-2888-0x0000000006810000-0x0000000006822000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/772-2692-0x0000000000400000-0x0000000000490000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/772-2693-0x0000000005400000-0x0000000005544000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/772-2776-0x0000000005C70000-0x0000000005E5A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/772-2889-0x0000000006890000-0x00000000068E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/872-168-0x0000000000400000-0x000000000073A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1000-2-0x0000000005280000-0x00000000052A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1000-5-0x00000000052D0000-0x00000000052E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1000-4-0x0000000008050000-0x00000000085F6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1000-0-0x0000000000520000-0x0000000000760000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1000-3-0x0000000002B50000-0x0000000002B56000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1000-1-0x00000000076D0000-0x0000000007A36000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1060-567-0x0000000009B50000-0x0000000009B6E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1060-240-0x0000000006250000-0x0000000006412000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1060-566-0x0000000007290000-0x0000000007306000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1060-218-0x0000000004F50000-0x000000000505A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1060-241-0x0000000006950000-0x0000000006E7C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1060-217-0x0000000004CF0000-0x0000000004D3C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1060-216-0x0000000004CB0000-0x0000000004CEC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1060-215-0x0000000004B50000-0x0000000004B62000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1060-214-0x00000000050E0000-0x00000000056F8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1060-213-0x0000000000200000-0x000000000021E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1060-242-0x00000000064C0000-0x0000000006552000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1096-634-0x0000000000F50000-0x0000000001274000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1576-201-0x0000000000990000-0x0000000000E25000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1576-183-0x0000000000990000-0x0000000000E25000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1680-1580-0x00000000000F0000-0x0000000000585000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1680-2300-0x00000000000F0000-0x0000000000585000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/1680-2417-0x00000000000F0000-0x0000000000585000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/2288-730-0x0000000000400000-0x0000000000754000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3000-45-0x0000000000FD0000-0x00000000012C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3000-41-0x0000000000FD0000-0x00000000012C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3184-670-0x0000000005610000-0x00000000056A6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3184-666-0x0000000005610000-0x00000000056A6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3184-669-0x0000000005610000-0x00000000056A6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3184-668-0x0000000005610000-0x00000000056A6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3184-667-0x0000000005610000-0x00000000056A6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3512-2925-0x0000000000420000-0x00000000008AB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3512-2880-0x0000000000420000-0x00000000008AB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3752-644-0x0000000003170000-0x0000000003182000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3752-643-0x000000001C640000-0x000000001C6F2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3752-645-0x000000001C5C0000-0x000000001C5FC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/3752-641-0x0000000003100000-0x0000000003150000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4004-826-0x000002189FA30000-0x000002189FD37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4004-835-0x000002189FA30000-0x000002189FD37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4004-832-0x000002189FA30000-0x000002189FD37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4004-828-0x000002189FA30000-0x000002189FD37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4004-831-0x000002189FA30000-0x000002189FD37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4004-834-0x000002189FA30000-0x000002189FD37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4004-833-0x000002189FA30000-0x000002189FD37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4004-830-0x000002189FA30000-0x000002189FD37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4004-829-0x000002189FA30000-0x000002189FD37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4004-827-0x000002189FA30000-0x000002189FD37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4004-836-0x000002189FA30000-0x000002189FD37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4124-672-0x0000000000400000-0x000000000045E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4124-673-0x0000000000400000-0x000000000045E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4560-819-0x0000000000230000-0x000000000025F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4560-965-0x0000000000230000-0x000000000025F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4832-614-0x0000000000400000-0x000000000045E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/4832-613-0x0000000000400000-0x000000000045E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-955-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-822-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-741-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-748-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-765-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-712-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-713-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-767-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-714-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-772-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-843-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-775-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-817-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-881-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-825-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-964-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-952-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-847-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-951-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-860-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-840-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-883-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-740-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-876-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-878-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5128-882-0x000001A94D630000-0x000001A94D698000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5296-589-0x0000000076D30000-0x0000000076F82000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5296-587-0x00007FF935720000-0x00007FF935929000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5296-579-0x0000000003920000-0x0000000003992000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5296-582-0x0000000003A40000-0x0000000003AD6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5296-581-0x0000000003920000-0x0000000003992000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5296-578-0x0000000003920000-0x0000000003992000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5296-580-0x0000000003920000-0x0000000003992000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5296-585-0x0000000003DE0000-0x00000000041E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5296-586-0x0000000003DE0000-0x00000000041E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/5332-1462-0x0000000005240000-0x000000000528C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/6112-28-0x0000000007510000-0x00000000075A6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/6112-15-0x0000000005780000-0x00000000057E6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/6112-27-0x00000000064D0000-0x000000000651C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/6112-29-0x00000000069C0000-0x00000000069DA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/6112-26-0x0000000006490000-0x00000000064AE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/6112-12-0x0000000005020000-0x0000000005056000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/6112-25-0x0000000005FC0000-0x0000000006317000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/6112-13-0x00000000057F0000-0x0000000005E1A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/6112-14-0x00000000054E0000-0x0000000005502000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                      memory/6112-16-0x0000000005E90000-0x0000000005EF6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                      Download