Analysis

  • max time kernel
    129s
  • max time network
    130s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/04/2024, 11:07

Errors

Reason
Machine shutdown

General

  • Target

    8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab.exe

  • Size

    5.5MB

  • MD5

    701c4e45fa484bab72325df9cee69c80

  • SHA1

    d0b7535defb7d3141b55022312d740833fae8f2b

  • SHA256

    8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab

  • SHA512

    a6a3a2bd483b84e7057eb71f3215602a78c12cf37782eb6af5b1d0461ffa4e8d6834921ef9b2557211aa12cccd4fbde8e4b2c0d6ecdfbbb1e7b21ff22413f395

  • SSDEEP

    49152:xIFzxLh+7KFc/rfltudWjXjGjYBJTcWIQKY6sB+gk89esANH1vcUbgkE4W4ed+aW:8h+PL1rkPFDO3RUdSI9LwrYbn

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 18 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Registers COM server for autorun 1 TTPs 14 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 40 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 13 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab.exe
    "C:\Users\Admin\AppData\Local\Temp\8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5048
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Users\Admin\Pictures\JlrDisb6QpmQ9haRBnx0XPia.exe
        "C:\Users\Admin\Pictures\JlrDisb6QpmQ9haRBnx0XPia.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:984
        • C:\Users\Admin\AppData\Local\Temp\urc.0.exe
          "C:\Users\Admin\AppData\Local\Temp\urc.0.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:3264
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HCBGDGCAAK.exe"
            5⤵
              PID:656
              • C:\Users\Admin\AppData\Local\Temp\HCBGDGCAAK.exe
                "C:\Users\Admin\AppData\Local\Temp\HCBGDGCAAK.exe"
                6⤵
                • Executes dropped EXE
                PID:4968
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\HCBGDGCAAK.exe
                  7⤵
                    PID:3080
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 2.2.2.2 -n 1 -w 3000
                      8⤵
                      • Runs ping.exe
                      PID:3588
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 3412
                5⤵
                • Program crash
                PID:1124
            • C:\Users\Admin\AppData\Local\Temp\urc.1.exe
              "C:\Users\Admin\AppData\Local\Temp\urc.1.exe"
              4⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1416
              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4072
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 1172
              4⤵
              • Program crash
              PID:932
          • C:\Users\Admin\Pictures\fLFBog0wp6NBRBqe0KRLGOMA.exe
            "C:\Users\Admin\Pictures\fLFBog0wp6NBRBqe0KRLGOMA.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4156
            • C:\Users\Admin\AppData\Local\Temp\7zS8628.tmp\Install.exe
              .\Install.exe /dEKGWdidYWnQ "385118" /S
              4⤵
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Drops file in System32 directory
              • Enumerates system info in registry
              • Suspicious use of WriteProcessMemory
              PID:2492
              • C:\Windows\SysWOW64\forfiles.exe
                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2028
                • C:\Windows\SysWOW64\cmd.exe
                  /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:716
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                    7⤵
                      PID:576
                    • \??\c:\windows\SysWOW64\reg.exe
                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                      7⤵
                        PID:3872
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2100
                    • C:\Windows\SysWOW64\cmd.exe
                      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2480
                      • \??\c:\windows\SysWOW64\reg.exe
                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                        7⤵
                          PID:1652
                        • \??\c:\windows\SysWOW64\reg.exe
                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                          7⤵
                            PID:4372
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /CREATE /TN "gyIvWaLIy" /SC once /ST 03:42:41 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                        5⤵
                        • Creates scheduled task(s)
                        PID:1896
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /run /I /tn "gyIvWaLIy"
                        5⤵
                          PID:2032
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /DELETE /F /TN "gyIvWaLIy"
                          5⤵
                            PID:4972
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 11:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\dnqwiTo.exe\" hl /Uasite_idlfg 385118 /S" /V1 /F
                            5⤵
                            • Drops file in Windows directory
                            • Creates scheduled task(s)
                            PID:3472
                      • C:\Users\Admin\Pictures\4uvUAteuguw1CkjoosA4Oh3Y.exe
                        "C:\Users\Admin\Pictures\4uvUAteuguw1CkjoosA4Oh3Y.exe"
                        3⤵
                        • Modifies firewall policy service
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1444
                      • C:\Users\Admin\Pictures\buTfUAKLG6Z7VwsHgBNeoZ5x.exe
                        "C:\Users\Admin\Pictures\buTfUAKLG6Z7VwsHgBNeoZ5x.exe" --silent --allusers=0
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Enumerates connected drives
                        • Modifies system certificate store
                        • Suspicious use of WriteProcessMemory
                        PID:3332
                        • C:\Users\Admin\Pictures\buTfUAKLG6Z7VwsHgBNeoZ5x.exe
                          C:\Users\Admin\Pictures\buTfUAKLG6Z7VwsHgBNeoZ5x.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6e6fe1d0,0x6e6fe1dc,0x6e6fe1e8
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:1808
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\buTfUAKLG6Z7VwsHgBNeoZ5x.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\buTfUAKLG6Z7VwsHgBNeoZ5x.exe" --version
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:3032
                        • C:\Users\Admin\Pictures\buTfUAKLG6Z7VwsHgBNeoZ5x.exe
                          "C:\Users\Admin\Pictures\buTfUAKLG6Z7VwsHgBNeoZ5x.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3332 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240403110811" --session-guid=14d3e9af-41e2-4e91-a771-932e32cd12c1 --server-tracking-blob=YjBkNTlmMTU5YTA5ZjFlYWVjMGQ4Y2FlOWM0NzVjNmQyNTFjODRmNTFhZjI0NjFjYzRjMjcwOGRiNGQ3MWU3Yjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N18xMjMiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIxNDI0ODYuNjgxOCIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N18xMjMiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjRmOWU0M2UyLTRlN2QtNDc3My1iNmIwLTE2M2Y2YWIwYzdkNSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2804000000000000
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates connected drives
                          • Suspicious use of WriteProcessMemory
                          PID:784
                          • C:\Users\Admin\Pictures\buTfUAKLG6Z7VwsHgBNeoZ5x.exe
                            C:\Users\Admin\Pictures\buTfUAKLG6Z7VwsHgBNeoZ5x.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6dc2e1d0,0x6dc2e1dc,0x6dc2e1e8
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:3828
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108111\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108111\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
                          4⤵
                          • Executes dropped EXE
                          PID:3172
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108111\assistant\assistant_installer.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108111\assistant\assistant_installer.exe" --version
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:2660
                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108111\assistant\assistant_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108111\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0xe60040,0xe6004c,0xe60058
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:880
                      • C:\Users\Admin\Pictures\8WRinhYPmXJoVFf980Ft3cF1.exe
                        "C:\Users\Admin\Pictures\8WRinhYPmXJoVFf980Ft3cF1.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:4924
                        • C:\Users\Admin\AppData\Local\Temp\7zSA97E.tmp\Install.exe
                          .\Install.exe /dEKGWdidYWnQ "385118" /S
                          4⤵
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Enumerates system info in registry
                          PID:2108
                          • C:\Windows\SysWOW64\forfiles.exe
                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                            5⤵
                              PID:4512
                              • C:\Windows\SysWOW64\cmd.exe
                                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                6⤵
                                  PID:3160
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                    7⤵
                                      PID:1116
                                    • \??\c:\windows\SysWOW64\reg.exe
                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                      7⤵
                                        PID:4900
                                  • C:\Windows\SysWOW64\forfiles.exe
                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                    5⤵
                                      PID:404
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                        6⤵
                                          PID:3128
                                          • \??\c:\windows\SysWOW64\reg.exe
                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                            7⤵
                                              PID:4492
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                              7⤵
                                                PID:2008
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /CREATE /TN "gfWPSzmcl" /SC once /ST 10:58:34 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                            5⤵
                                            • Creates scheduled task(s)
                                            PID:3804
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /run /I /tn "gfWPSzmcl"
                                            5⤵
                                              PID:1124
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /DELETE /F /TN "gfWPSzmcl"
                                              5⤵
                                                PID:1272
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 11:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\SnjMgxW.exe\" hl /vMsite_idCXg 385118 /S" /V1 /F
                                                5⤵
                                                • Drops file in Windows directory
                                                • Creates scheduled task(s)
                                                PID:1244
                                          • C:\Users\Admin\Pictures\cymoeqqwvGpbZ2JBspmlizbe.exe
                                            "C:\Users\Admin\Pictures\cymoeqqwvGpbZ2JBspmlizbe.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            PID:3784
                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                                              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                                              4⤵
                                              • Executes dropped EXE
                                              PID:1124
                                              • C:\Windows\SYSTEM32\msiexec.exe
                                                "msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"
                                                5⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2940
                                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe
                                                "ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"
                                                5⤵
                                                • Executes dropped EXE
                                                PID:2032
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 984 -ip 984
                                        1⤵
                                          PID:1984
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                          1⤵
                                            PID:408
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                            1⤵
                                              PID:2236
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                              1⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2476
                                              • C:\Windows\system32\gpupdate.exe
                                                "C:\Windows\system32\gpupdate.exe" /force
                                                2⤵
                                                  PID:3236
                                              • C:\Windows\system32\gpscript.exe
                                                gpscript.exe /RefreshSystemParam
                                                1⤵
                                                  PID:576
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                  1⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2092
                                                  • C:\Windows\system32\gpupdate.exe
                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                    2⤵
                                                      PID:1464
                                                  • C:\Windows\system32\gpscript.exe
                                                    gpscript.exe /RefreshSystemParam
                                                    1⤵
                                                      PID:1524
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3264 -ip 3264
                                                      1⤵
                                                        PID:3980
                                                      • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\SnjMgxW.exe
                                                        C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\SnjMgxW.exe hl /vMsite_idCXg 385118 /S
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        PID:2104
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3476
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:2824
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                4⤵
                                                                  PID:4524
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:3508
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:3516
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:1480
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:4756
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:2008
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:4628
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:1288
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:3048
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:1580
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:2944
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:452
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:4492
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:832
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:1584
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:936
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:4424
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:4392
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3168
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4640
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:1216
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1116
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4312
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:4300
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:1416
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:3512
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:4236
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:4008
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                    2⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:2432
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:5072
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                          4⤵
                                                                                                                            PID:3080
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:1804
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:1908
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:3128
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:3176
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:1336
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:5116
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:3896
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:2972
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:408
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:3860
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:656
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:3784
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4512
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5104
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1984
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1100
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1448
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1504
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4996
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /CREATE /TN "gLmPpIMUD" /SC once /ST 05:44:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                              2⤵
                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                              PID:4900
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /run /I /tn "gLmPpIMUD"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1972
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /DELETE /F /TN "gLmPpIMUD"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2160
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /CREATE /TN "ZJggANjsYpCqsGjEe" /SC once /ST 10:24:31 /RU "SYSTEM" /TR "\"C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\jyVPweM.exe\" UK /Ahsite_idbYP 385118 /S" /V1 /F
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                  PID:2748
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /run /I /tn "ZJggANjsYpCqsGjEe"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2520
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:3992
                                                                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2824
                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:2172
                                                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1336
                                                                                                                                                                      • C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\jyVPweM.exe
                                                                                                                                                                        C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\jyVPweM.exe UK /Ahsite_idbYP 385118 /S
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops Chrome extension
                                                                                                                                                                        • Drops desktop.ini file(s)
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:3816
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /DELETE /F /TN "bCAdHbOFiqtMCRhbmR"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2432
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4300
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4372
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1652
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:692
                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\FkTKFe.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                    PID:132
                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                    schtasks /CREATE /TN "eGwAoTnpAObQfPU2" /F /xml "C:\Program Files (x86)\yvWovCiVU\qFtCDwZ.xml" /RU "SYSTEM"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                    PID:1416
                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                    schtasks /END /TN "eGwAoTnpAObQfPU"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3260
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /DELETE /F /TN "eGwAoTnpAObQfPU"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:132
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /CREATE /TN "ALvbXdfFiQJKEp" /F /xml "C:\Program Files (x86)\LCifMpYymZWU2\yCrzHCd.xml" /RU "SYSTEM"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:3188
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /CREATE /TN "BIiSjOILpRnDn2" /F /xml "C:\ProgramData\WkkDuRgYrrqHXcVB\uAWseFF.xml" /RU "SYSTEM"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:4116
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /CREATE /TN "uCAhUOuaRBfXDMltv2" /F /xml "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\rwODtGD.xml" /RU "SYSTEM"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:4132
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /CREATE /TN "cLzKLCJHWfKFSkdKasF2" /F /xml "C:\Program Files (x86)\mVqQIGUXDOgrC\AoEwiXE.xml" /RU "SYSTEM"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:3896
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /CREATE /TN "kkPqOHrufYpxTagPJ" /SC once /ST 10:06:24 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\IzRZTwSZebgYVSAl\ilLTDNLc\CPrIjlC.dll\",#1 /bZsite_idAyC 385118" /V1 /F
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:4196
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /run /I /tn "kkPqOHrufYpxTagPJ"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3652
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5012
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2572
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1624
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1408
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /DELETE /F /TN "ZJggANjsYpCqsGjEe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:3832
                                                                                                                                                                                                • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\ilLTDNLc\CPrIjlC.dll",#1 /bZsite_idAyC 385118
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:656
                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\ilLTDNLc\CPrIjlC.dll",#1 /bZsite_idAyC 385118
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                      PID:3860
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        schtasks /DELETE /F /TN "kkPqOHrufYpxTagPJ"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:3160
                                                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                                                      • Registers COM server for autorun
                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:4984
                                                                                                                                                                                                      • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                        C:\Windows\System32\MsiExec.exe -Embedding 3E058CB92B989889371DA01B31E6A85E
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        PID:1204
                                                                                                                                                                                                      • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                        C:\Windows\System32\MsiExec.exe -Embedding 26F25333D6A30159C67D03CA1ED86B45 E Global\MSI0000
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Drops file in Drivers directory
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                        PID:5012
                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 5D19C6B0C9679188623ECAE4921448F7 M Global\MSI0000
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1580
                                                                                                                                                                                                      • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                        "LogonUI.exe" /flags:0x4 /state0:0xa39a3055 /state1:0x41c64e6d
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                        PID:1624

                                                                                                                                                                                                      Network

                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                            • C:\Config.Msi\e592cb6.rbs

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              898KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              b44d1b3903cce978a5e1e2a43c9b9ebc

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              99cb4cb378a9e44f36655587e17119b593186c29

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              3c2a75554cc064ac8fd5064a85ba5bb47de352f99067a7b1d03900196894ad5d

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              1c34c699fbdbad59c5ff26fed2bc5f4c1080e2502ffb0b02202d7a0eecf42be107c3f1db6420fad6d3717b63068a1636ed259e97c1c4b29e1053fa8da7276922

                                                                                                                                                                                                            • C:\Program Files (x86)\LCifMpYymZWU2\yCrzHCd.xml

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              9832710a494163fd6988b242bf8a3ae1

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              e0b839ea2fd61144c437a6c9a997e999977dd894

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              be9a7bf50bfbdfdca845e328aff346c4ea059ba5d3b11e5b10d0867cfbbb038c

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              c7c9ee6fb8c549dcde77d48d277bbb6324eb9f8b50fb76d73db9ba2ecba0ae286a9d373a692f770dcaf09977f578338c276826e76d50b53d8c1f45838b91ac1b

                                                                                                                                                                                                            • C:\Program Files (x86)\mVqQIGUXDOgrC\AoEwiXE.xml

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              735e771b78493f1c27e1c2b42758873d

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              16e07fdcbbd63a91861919f5f498bda1cc67d50f

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              77d187fff555ba317ccfa42fdf0ea0ee41dbde5120bb3168fb28900d208b7456

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              89080b30ccc1bec7606ec7787d21ae7991977b214a89d343de2bb0ccdfff4d785215c4f38b8d0cda7707865f8743bdbc8e0606722741315fea49b37e9eb49a31

                                                                                                                                                                                                            • C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\rwODtGD.xml

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              62717cc5cb7ca197d10284ff9e8c6439

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              7ad5c46f9a83cd753b13be617eda82b61404d22c

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              65e715df888569c544abf2fb46c1a5dd29b79cc5dac0e7c5fcf162f6f7b8e929

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              8b1db961915267941df8faa64c1c4ddfeec61b2a90a6d9ad3d4e8af1ff00f6da957db1385a22617e27a4b61ca6ec7eb013bc04542a7913e1bd21521f844ad31d

                                                                                                                                                                                                            • C:\Program Files (x86)\yvWovCiVU\qFtCDwZ.xml

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              e0baa3ddc3373356d811a119d428cf04

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              ab05b5c36eb1dc3ef28be1c55d63921f480d034d

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              f3f73e3e1167371bde6e231dfb36e80919be60e5b75cc34077ab730dfd782851

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              aff8166dbb69664235fcdd02a9d6d5713c2a8974cc52153afa6cf78f5e61c2cf1c2aab01de323f7f189376fc164024bb6439314b8e96c95bc23584e295f4599a

                                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2.0MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              81d5b5fa9c8715c8508d70a119c174af

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              47ba968c1d8b0bc987753cf12b3f155e3c42639f

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              e483d961cf24ec0d7cff0424498aa76752720c975ea893c362481645dbadf37c

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              f7c8100a3e689a147188670b96399040f5642d5bd88e1d64343c03bc0dbf7eb0c8daf34afd3f2803a0e14b0bbf56f045e5cf6c7142aa6682fc2d77d41b969a53

                                                                                                                                                                                                            • C:\ProgramData\Are.docx

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              a33e5b189842c5867f46566bdbf7a095

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                                                                                                                            • C:\ProgramData\WkkDuRgYrrqHXcVB\uAWseFF.xml

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              dc40b65e2ac9badd0f957c22db8d1fcc

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              a8a988e7d5dc1d54b44de6db17376c6bbeb89c96

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              232fb636084886cc1fe4b5a7fff9cf1f8ff70bf7b43713b8bcf20723f8717e29

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              d73c667615a90c96096cb4d3294d44b641a2331785176373e33ca90f2a0921f347c5d289b0b02752dda60ac6ed5e0ec1b8791f48a9715859366e8f92d6ca6e4b

                                                                                                                                                                                                            • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              593KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                            • C:\ProgramData\nss3.dll

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2.0MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              187B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              136B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              150B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ecebf557b2beb7f5c4161265816d885b

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              eed1c25a398f10de79c97b1b5ae172fdf6a8de88

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              492e52e5559cfc363f88aa71c6fbc3d2567561f4484d35bb1131593d483b9c3e

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              658b8541e29f0903af0368f181cca004dbc7f228db4040cf8b6bd10687329cfe04bc29195ab95d542a4f4dd177f6823b26c3a87c4ac7ffc8d1605741d9f98124

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              34KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              1f57ea3d5a6927254b9c0660a76d9b9c

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              b0de5996c1ec9cbd9caefed865c0058a3e098256

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              d240af67ad846f3b363ed74f45205a0b168baa788aca8dbcfac221c29a1966d2

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              03b809cda384156779c384d0e6ffee2d865f20cb16e2e8d1e9666dacb50468adcad991dca84456c6515c138cccbae65766b43ec9b41503e429daad56eaa6e23a

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              627073ee3ca9676911bee35548eff2b8

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              151B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              944B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              1a9fa92a4f2e2ec9e244d43a6a4f8fb9

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              9910190edfaccece1dfcc1d92e357772f5dae8f7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              160686950a7637fa8f632f3a3556f1f8

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              e74756f9d31a5f014f5cf2d2a22f41267d88b404

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b0e7b095b7ab92461c7320e1bc23257e8256650cdb0b829dfd26875e1c985f47

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              1ef4c711fe5b4f0dd8644cb4f1eade4743e8aa6f2d962e1189c7e974a00020a6ebdc49657230111155f7447b4f238cd8897b8308e2b2517fba2a590053aff360

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              446dd1cf97eaba21cf14d03aebc79f27

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              36e4cc7367e0c7b40f4a8ace272941ea46373799

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108111\additional_file0.tmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              2.5MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              20d293b9bf23403179ca48086ba88867

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              dedf311108f607a387d486d812514a2defbd1b9e

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108111\assistant\assistant_installer.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1.9MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              b3f05009b53af6435e86cfd939717e82

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              770877e7c5f03e8d684984fe430bdfcc2cf41b26

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              3ea8d40fcede1fc03e5603246d75d13e8d44d7229d4c390c39a55534053027f7

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              d2dee80aaa79b19f1eb1db85079a05f621780e06bfea9e838b62d757ba29399f9090ec7c6ff553377c9b712f3ba8dd812cdff39f3e28829928e86746a8ac6b27

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108111\assistant\dbgcore.DLL

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              166KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              8b6f64e5d3a608b434079e50a1277913

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              03f431fabf1c99a48b449099455c1575893d9f32

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              926d444ffca166e006920412677c4ed2ef159cf0efc0578cb45b824f428f5eb2

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              c9aeac62ece564ac64a894300fb9d41d13f22951ead73421854c23c506760d984dff0af92bef2d80f3a66e782f0075832e9c24a50ae6110d27a25c14e065b41c

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108111\assistant\dbghelp.dll

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              925ea07f594d3fce3f73ede370d92ef7

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              f67ea921368c288a9d3728158c3f80213d89d7c2

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6d02ebd4ec9a6093f21cd8ccefb9445fa0ab7b1f69ac868a5cfc5d28ed8d2de9

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              a809851da820d9fdd8fb860a8f549311dcc2579df2c6f6fba74f50d5d8bf94baa834b09fb5476ac248f18d1deb6b47d4fdd6d658889d5d45ca8774a9264483d2

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031108111\opera_package

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              103.9MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              f9172d1f7a8316c593bdddc47f403b06

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              ed1e5a40b040af2c60ed6c2536b3bf7ee55e0e52

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              f51ab2bdf29ca6839e4f7cf1fac1bdfc03ba2da4569a8f21e5d2ee13e6519097c3da40bf0b4ca7642286ed033d0126bbd14ef7842eb9f2db1d6e503849521b02

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8628.tmp\Install.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              6.9MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ea99e72c1ac89aa9cc14178b1c46d50d

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              60b896781f40e89106d0c76abd11c5b5d0832943

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9cd503eed313e3c5293f192804c0f20a4eef448876f8375fbc26a25be36d5b28

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              03693bda0c8b693c09e416a7d0c335294f74804f336058a59612a07aa0dd918cd70958cc95feba7d3b26b2df235b0a60d0347d6ed6e353fec8c87c969f6068f1

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSA97E.tmp\AppVDllSurrogate.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              185KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              44e7959ad65710514415da2f7c08cfec

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              caa54e521e449f9263b43bfce9e2fca6fb4cab14

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9242b4ccd537494c43c3f675227aed8da9842bf3a2375c32356e05d4532f190e

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              aaab6ac285f2a6fcd914bbd19a82ef571d97a60e24a02f0979ddcefe5a87192d6f609e055f90c4cf1a8f20eed479518fbc51420dc8461e6fdc9027032c9ab555

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSA97E.tmp\Info.xml

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              3KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0456be6047774e5d0b8045b787048924

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              76f6445368a4462a50e502bc272a8efc2eb33cb0

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              1c4440a8312e16bc682277164cc6710b37fc3dcac5ef9aa0ba7e77fc0c1f4897

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              c0f0cf97e0fd0b258b9a9fa6466dd9e390cd79f3edb0f5b9f10137c241c6b079061135c44c0c30dc71c28f1b7b929c65eb1112761e53cd8400d7e07ce1a7b99c

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSA97E.tmp\atieah64.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              454KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              bbd4e96b91fcf16a38da733c6939d47f

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              66073fff85d4fbd9de5102c70096c7dbb4ff5a6e

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              5fd16e242c136447fb7b0ffbd8cbff3635b05c94cd90af3f1e99fad7ef6295e5

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9adeceb309c33217b2e4a5dfe343306fabd4fc2b62d9ba860f52bc6af84d6f7f078890b7d0e7dd4d54467315c2426722c77485419e6b40f5acced27472b71729

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSA97E.tmp\auditpol.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              56KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              24267a44ee6ff87e41500ce0ca87b405

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              2e7a083a4f32519d13481f439034bb9ca3bf5b00

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              cdeff13f4ef1f7dd953d4496d253f6e7dddf53d60d0797f66fc249cdf4aada8b

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              a1cfc9249ca98e1ea60ac34eef34b07dcf926c42e64e1f8d839ec0e5f94248540362b228c84e948bd9b34d6a546efbdefb8d00226727cc033cb932a81cc5d5c5

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSA97E.tmp\bthudtask.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              77a4a6742bc4ab3d18868f0e6d52c0ea

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              72c38c47d7bc7ad2f7152356f0fd8a41ebe37c0b

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              3f4ff1e9a0c5f9aea7874ffd493ecd405aca7dc79201dcfb6df6bfb695d714a7

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              97a45e72c04eb21733a04c21699af0a368ff4ae71511a25b134aae96068d562687ab240826b526e9fece2e7bd11bfc195feb5413affa0025838bef97d7c7b23a

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\HCBGDGCAAK.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              106KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              fe380780b5c35bd6d54541791151c2be

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              7fe3a583cf91474c733f85cebf3c857682e269e1

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404031108113803332.dll

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.6MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              2a3159d6fef1100348d64bf9c72d15ee

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              52a08f06f6baaa12163b92f3c6509e6f1e003130

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              251c0d3cdd0597b962d4e32cf588a82454c42067cbe5e35b41b0548eea742ea25815e5d6830b63c1992b5730a4e6d7c005fb0019aa4c389549b06fff9a74b38c

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_om2rynrf.qd0.ps1

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              60B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              3KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              5bdfcbd607242fb7391e135681fb1c8c

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              372b60a0f699e32129d9ea5e7fb66445c4fc31ef

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              004d1b760eeca27c30062cc534a9f62cafd18528fb7c7cde6519feb11b15d90f

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              94bf14d42333d41e8c06a10b69a8970b7b923a5946a7b442b55a2cc6d5dc1241b458fd78f6d612db1fb493b4a854da41d0cdf9f7cf7e84ec2dea56eb630f1450

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\urc.0.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              288KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              51e3ef0a1d7922b7f8a12d2f71884f1a

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              c4d962755aff62b1645e930e516fed964dfe2d78

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              34567116a4502f378362327e1cde0dcaed0cee3c62f9fa651e8d52d44e49e54e

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e1c6413dbb16434372afcb99c068971ef5a72243768488e93adb915f32c3850f7e34ecb1967b669e2bd658ff7f1e185c009bc7caff8753cc5ba42910145575f7

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\urc.1.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.6MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d8xutbrp.default-release\prefs.js

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              6KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              775a3d5cdf4629a3d2a4562845235cf7

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              b4f32fecc2fbfe237313c07cee8929b430907724

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b8f1e491d6c82a7588418e3e58dce6381109ff5856a98c150408ca37ffb2c312

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              c8d2a086b3d4863f2244b92dd3cecf94adbb72878d5d2dc0531d8ef746fcb719f6310818bc44eb6d6716e6f8264b76f72d27b848b522bd460d1fad2eb0c70199

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              40B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              e749e950534be3c39abc93717dc10d54

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              0ee9dbdac0490461acb638678adc32a9af7a045b

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              1c536af49e20784db1d4aa255d0196c889cd1901625ca0a0edc57f7fc621f088

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              8aa8570c37be77fe59e8c72f5cc87b1004dc53e45a2200bf47a9f3f445f3f5d8246487dcb5f71cf3839832773243c2e8a651f81786068ad69b60e13677253da9

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\3QQxECqyrqQ0EdH9wR0TjN6D.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              7KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\4uvUAteuguw1CkjoosA4Oh3Y.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              6.3MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ba4cc3d695d24829034cc600780ac844

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              40725565975fc93a7dcd43e2e135169a01dda131

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              5a5e8c3155eea9a46d47176882d419e8f4cf3d740e600b0fc2162740abfb1072

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              c714a290cd4487f411a81f638782a3c7e939dcce0fc70870556c2a7c65e1e244a3dd001354c88e79332037d57bd515de256542e5cef3bffb1ff5ad0dff75353f

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\JlrDisb6QpmQ9haRBnx0XPia.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              430KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              fb44368b17af12d6000e878aa517df47

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              e84c641889d69857d94851c0bfeb72fd049983af

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              80185fe8fd6565c4d6f5467feeed45a68836de40db53facef94c0c5bffebac93

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              939a49d398535b078573578d82cbbe17dbabba69b81e1d54c58ea53b64f053deb5713b4236e66e2fb77b975c29d9b56a95cdfa513020b03b03e03d352cfb074f

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\buTfUAKLG6Z7VwsHgBNeoZ5x.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.1MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0b9751f203b5e88a92eff6c3d9e9b17c

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              86d3099f3b82f1a9d2c0d4c28ba89e368808fdd6

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              1dc39214316ecea6118572633fe29d14959098b4d5b80fb47be9d3a315316ed6

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              d2528599e260358f86fd380ad3146b0dd979f38ab6498600ab3c69c486c1ddd3fa553862100ba683325770e7a1ae61ee60d6ac45848b1cd568f375a3c574d18e

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\cymoeqqwvGpbZ2JBspmlizbe.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              108.6MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              d2a1400da7889266674cc21bbcb82f3a

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              cb9121fbcf78a38fedcca0d16630b9c038108e83

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              ca6a2a6e7a3361c22c40900f58d221a1a337cd4a44e4e97840bb7e85a5f5085a

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              d677bc46a0a8660c7c486ccd756920f24f85d5b1887711e74829f4eb74f411a4b7d3f519303d972d32adfeb7b1bc9fd7da0f5fbb75b2d172c461510a4a65d5bf

                                                                                                                                                                                                            • C:\Users\Admin\Pictures\fLFBog0wp6NBRBqe0KRLGOMA.exe

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              6.6MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              043dbd643661057bd57f2b5fef28d155

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              08819d63ab2f4641aaf891575b46f3b458045fa2

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              cd397b8859f41846902412c7a48da2adf6f5c0dba1497457009e0495aa01fda6

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              b5abb4082995d7f2b653d7621afceb8b0c455cc0379d7d6c643cf6c43d2e3e24fbdfb391f18cea1c5b7af51be99f2e128f587be2c71e18e6ad0c88a66ff56439

                                                                                                                                                                                                            • C:\Windows\Installer\MSI462C.tmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              195KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              4298cfa3dab9867af517722fe69b1333

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              ab4809f8c9282e599aa64a8ca9900b09b98e0425

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              37b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b

                                                                                                                                                                                                            • C:\Windows\Installer\e592cb3.msi

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              101.9MB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              a198248d82bcfe0548af2dd8b5d234c9

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              b48db4ee1171682510b7f9768a119da78937f0bd

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              5e4fd3d3aa4666014213cd384da90d59bcd77bc7ae7fedcb6951e9c4945fc0fb

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              ebff424004dccf67613e3caa5a04d6865f581125cec31539d86d9bc89e89a0571f979c1a877d651bbcb63aa4cc1c6569cc6af64d69dd0a9b0ddde28b0e24d878

                                                                                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              5b74da6778ccaa0e1ca4ae7484775943

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              0a2f6f315a0ca1a0366b509aec7b13c606645654

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              172282931d7eeb60228e6b9b4b913fd78c73f2a7855620f35fb24a5c847b6c78

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              20b4cb7174f49b22426b249f1dfc8f6273f50d1502536e773f4dcd073bf027f2a554d2437c2dc628dbe021c5c3b968b2d89f810ff1bb19630c1560e7feee1a1a

                                                                                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              11KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              1bfdae3c8a93b2215591e25bad55c3ba

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6c97a06d80b15350a051b7f96d035363c14d98d1

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              7da1f2041eb1a25d37569fea8417bc7d1837b43e81a38045ec80422f384652b3

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              c63e5324307b2aa5857d52ead6abbb66105e36a6841240060d45b3fb9c720ee22bd560733df8de0721fa7bc0af827f1a3617eaef4cb215730a0a947edc4cedc3

                                                                                                                                                                                                            • C:\Windows\System32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1013KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              321ccdb9223b0801846b9ad131ac4d81

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              ac8fb0fc82a8c30b57962fe5d869fda534053404

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              05045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              75b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a

                                                                                                                                                                                                            • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              127B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                            • C:\Windows\Tasks\bCAdHbOFiqtMCRhbmR.job

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              522B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0ef4b596598413bc190b779319379a43

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              f5393dc67ba454225247d3e44417d18a56851bf0

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              81ecb1540ca868ce0e61dd5a13c88da7fbdab8ecb0254fafdcf4df89fd8346e2

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              3266ebe2b3a22602d2930cc362dd7805f852809dd7dac098290232bed81d15849ffaa7dc3322c909fcdb68bc1f4b5c2a9e637884a9c592af1a8d4d031321b44d

                                                                                                                                                                                                            • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              cdfd60e717a44c2349b553e011958b85

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                                                                            • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              8KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              000e87404bc4503cddd6268c5c572953

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              ed7602ef79c72eb94be1d2a727a876faf6240026

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              1b114017a7c8db0d45d6c1e934a1131a47168163b260af124f1b5011508ccc0f

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              7d4b6d272355dcf6ba77927b64f6f9f0d8968c00290f9bfb47fded0ede0f1448dfe1d9c485988398f9691baec3c95f29c3306d30c0b852a7e7b81c6f7f2a9b5a

                                                                                                                                                                                                            • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              268B

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                                            • memory/984-41-0x0000000000C30000-0x0000000000D30000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1024KB

                                                                                                                                                                                                            • memory/984-155-0x0000000000400000-0x0000000000889000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.5MB

                                                                                                                                                                                                            • memory/984-43-0x0000000000400000-0x0000000000889000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.5MB

                                                                                                                                                                                                            • memory/984-42-0x0000000002640000-0x00000000026AC000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              432KB

                                                                                                                                                                                                            • memory/1416-419-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.7MB

                                                                                                                                                                                                            • memory/1416-327-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.7MB

                                                                                                                                                                                                            • memory/1416-66-0x0000000002760000-0x0000000002761000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4KB

                                                                                                                                                                                                            • memory/1444-145-0x00007FF9E79B0000-0x00007FF9E79B2000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              8KB

                                                                                                                                                                                                            • memory/1444-150-0x00007FF747460000-0x00007FF74812F000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              12.8MB

                                                                                                                                                                                                            • memory/1444-429-0x00007FF747460000-0x00007FF74812F000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              12.8MB

                                                                                                                                                                                                            • memory/2068-18-0x0000000005830000-0x0000000005840000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/2068-16-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              32KB

                                                                                                                                                                                                            • memory/2068-17-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              7.7MB

                                                                                                                                                                                                            • memory/2068-255-0x0000000005830000-0x0000000005840000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/2068-231-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              7.7MB

                                                                                                                                                                                                            • memory/2092-381-0x00007FF9C6730000-0x00007FF9C71F2000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/2092-388-0x00007FF9C6730000-0x00007FF9C71F2000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/2092-382-0x000001ED77920000-0x000001ED77930000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/2092-383-0x000001ED77920000-0x000001ED77930000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/2104-490-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.9MB

                                                                                                                                                                                                            • memory/2108-301-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.9MB

                                                                                                                                                                                                            • memory/2476-267-0x00007FF9C6730000-0x00007FF9C71F2000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/2476-263-0x00007FF9C6730000-0x00007FF9C71F2000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/2476-265-0x0000018530910000-0x0000018530920000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/2492-149-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.9MB

                                                                                                                                                                                                            • memory/3264-367-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                            • memory/3264-371-0x0000000000BA0000-0x0000000000CA0000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1024KB

                                                                                                                                                                                                            • memory/3264-474-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                            • memory/3264-159-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              972KB

                                                                                                                                                                                                            • memory/3264-54-0x0000000000AD0000-0x0000000000AF7000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              156KB

                                                                                                                                                                                                            • memory/3264-250-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                            • memory/3264-55-0x0000000000400000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                            • memory/3264-53-0x0000000000BA0000-0x0000000000CA0000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1024KB

                                                                                                                                                                                                            • memory/3816-553-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.9MB

                                                                                                                                                                                                            • memory/3816-936-0x0000000003510000-0x000000000359A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              552KB

                                                                                                                                                                                                            • memory/3816-607-0x0000000002D30000-0x0000000002D95000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              404KB

                                                                                                                                                                                                            • memory/3816-565-0x00000000027E0000-0x0000000002865000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              532KB

                                                                                                                                                                                                            • memory/3816-953-0x00000000035A0000-0x0000000003675000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              852KB

                                                                                                                                                                                                            • memory/3860-941-0x0000000001A70000-0x0000000002058000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.9MB

                                                                                                                                                                                                            • memory/4072-439-0x0000029FC75C0000-0x0000029FC75CA000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              40KB

                                                                                                                                                                                                            • memory/4072-427-0x0000029FA9570000-0x0000029FACE68000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              57.0MB

                                                                                                                                                                                                            • memory/4072-442-0x0000029FC7980000-0x0000029FC79FA000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              488KB

                                                                                                                                                                                                            • memory/4072-484-0x00007FF9C6730000-0x00007FF9C71F2000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/4072-485-0x0000029FAEC00000-0x0000029FAEC10000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4072-486-0x0000029FAEC00000-0x0000029FAEC10000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4072-487-0x0000029FAEC00000-0x0000029FAEC10000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4072-488-0x0000029FAEC00000-0x0000029FAEC10000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4072-445-0x0000029FC75D0000-0x0000029FC75DA000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              40KB

                                                                                                                                                                                                            • memory/4072-441-0x0000029FC7650000-0x0000029FC7702000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              712KB

                                                                                                                                                                                                            • memory/4072-440-0x0000029FC7620000-0x0000029FC764A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              168KB

                                                                                                                                                                                                            • memory/4072-444-0x0000029FC7AE0000-0x0000029FC7B56000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              472KB

                                                                                                                                                                                                            • memory/4072-435-0x0000029FC7590000-0x0000029FC75B4000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              144KB

                                                                                                                                                                                                            • memory/4072-449-0x0000029FC7B60000-0x0000029FC7E60000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              3.0MB

                                                                                                                                                                                                            • memory/4072-451-0x0000029FAEC00000-0x0000029FAEC10000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4072-434-0x0000029FC7520000-0x0000029FC7534000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              80KB

                                                                                                                                                                                                            • memory/4072-452-0x0000029FCC560000-0x0000029FCC568000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              32KB

                                                                                                                                                                                                            • memory/4072-433-0x0000029FC7530000-0x0000029FC753C000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              48KB

                                                                                                                                                                                                            • memory/4072-432-0x0000029FAED40000-0x0000029FAED50000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4072-431-0x0000029FC7720000-0x0000029FC7830000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                            • memory/4072-430-0x0000029FAEC00000-0x0000029FAEC10000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4072-479-0x0000029FC8030000-0x0000029FC804E000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              120KB

                                                                                                                                                                                                            • memory/4072-422-0x00007FF9C6730000-0x00007FF9C71F2000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/4072-455-0x0000029FAEC00000-0x0000029FAEC10000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4072-468-0x0000029FC7F60000-0x0000029FC7F6C000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              48KB

                                                                                                                                                                                                            • memory/4072-467-0x0000029FC7FB0000-0x0000029FC8000000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              320KB

                                                                                                                                                                                                            • memory/4072-443-0x0000029FC7A00000-0x0000029FC7A62000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              392KB

                                                                                                                                                                                                            • memory/4072-462-0x0000029FCCD60000-0x0000029FCD288000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                            • memory/4072-461-0x0000029FCC810000-0x0000029FCC832000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              136KB

                                                                                                                                                                                                            • memory/4072-460-0x0000029FCC800000-0x0000029FCC80A000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              40KB

                                                                                                                                                                                                            • memory/4072-453-0x0000029FCBEE0000-0x0000029FCBF18000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              224KB

                                                                                                                                                                                                            • memory/4072-454-0x0000029FAEC00000-0x0000029FAEC10000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4072-456-0x0000029FCBEB0000-0x0000029FCBEBE000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              56KB

                                                                                                                                                                                                            • memory/4968-470-0x0000000000CE0000-0x0000000000D00000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              128KB

                                                                                                                                                                                                            • memory/4968-471-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              7.7MB

                                                                                                                                                                                                            • memory/4968-472-0x0000000005730000-0x0000000005740000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/4968-476-0x0000000074640000-0x0000000074DF1000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              7.7MB

                                                                                                                                                                                                            • memory/5048-8-0x0000023EFC0D0000-0x0000023EFC0F2000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              136KB

                                                                                                                                                                                                            • memory/5048-15-0x00007FF9C6730000-0x00007FF9C71F2000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                            • memory/5048-11-0x0000023EFC020000-0x0000023EFC030000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/5048-12-0x0000023EFC020000-0x0000023EFC030000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/5048-10-0x0000023EFC020000-0x0000023EFC030000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              64KB

                                                                                                                                                                                                            • memory/5048-9-0x00007FF9C6730000-0x00007FF9C71F2000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              10.8MB