Overview

overview

10

Static

static

1

winprofile

windows7-x64

1

winprofile

windows10-1703-x64

10

Resubmissions

09-04-2024 12:07

240409-paay5see45 9

09-04-2024 12:06

240409-n9qcfaee34 9

09-04-2024 12:06

240409-n9pqxahg7z 9

09-04-2024 12:05

240409-n9n5daee33 9

14-03-2024 04:54

240314-fjy8nadc63 10

Analysis

  • max time kernel
    300s
  • max time network
    308s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14-03-2024 04:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe.exe

  • Size

    45KB

  • MD5

    e533f92146fcacb8caca823882b8d304

  • SHA1

    fcb2b79d08e2fb7a58142faf7db2a36f142b309d

  • SHA256

    3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe

  • SHA512

    334b90d543b5835f88d3891c03fe78ac91c2569e47bfb11fbae58b9544fa569f411e4a2d8b57049a97f79afd51312eed57dd95c74b680331882ca77a46888c69

  • SSDEEP

    768:ygDUz4vSd32TINlRjiniKEc3dJ3Bwj+3p5SNUMNTEFiRQ:zUz4Kd320N+nir2FMN9NeiS

Score
10/10
gluptebasocks5systemzstealcbotnetdiscoverydropperevasionloaderpersistencerootkitspywarestealertrojanupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.145

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Extracted

Family

socks5systemz

C2

http://ejkhuuw.ua/search/?q=67e28dd8680cfb2d4008ab1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4fe8889b5e4fa9281ae978fe71ea771795af8e05c644db22f31df92d8838ed12a666d307eca743ec4c2b07b52966923a678df613c1e697

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 9 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Contacts a large (4085) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Drops startup file 5 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 1 IoCs
    installer
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe.exe
    "C:\Users\Admin\AppData\Local\Temp\3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4672
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:9196
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      2⤵
        PID:20144
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        2⤵
          PID:18064
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
          2⤵
          • Drops startup file
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:16828
          • C:\Users\Admin\Pictures\LpRhF8jaeig6QHkQ4x7HDip6.exe
            "C:\Users\Admin\Pictures\LpRhF8jaeig6QHkQ4x7HDip6.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:12300
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:20332
            • C:\Users\Admin\Pictures\LpRhF8jaeig6QHkQ4x7HDip6.exe
              "C:\Users\Admin\Pictures\LpRhF8jaeig6QHkQ4x7HDip6.exe"
              4⤵
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Adds Run key to start application
              • Checks for VirtualBox DLLs, possible anti-VM trick
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              PID:9472
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:20156
              • C:\Windows\System32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                5⤵
                  PID:13528
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    • Modifies data under HKEY_USERS
                    PID:13628
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:14256
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:20276
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe
                  5⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Manipulates WinMonFS driver.
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:15020
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:16064
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    6⤵
                    • Creates scheduled task(s)
                    PID:7780
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /delete /tn ScheduledUpdate /f
                    6⤵
                      PID:6852
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:8808
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:15796
                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                      6⤵
                      • Executes dropped EXE
                      PID:20164
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      6⤵
                      • Creates scheduled task(s)
                      PID:12732
                    • C:\Windows\windefender.exe
                      "C:\Windows\windefender.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:20292
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        7⤵
                          PID:13612
                          • C:\Windows\SysWOW64\sc.exe
                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            8⤵
                            • Launches sc.exe
                            • Suspicious use of AdjustPrivilegeToken
                            PID:10740
                • C:\Users\Admin\Pictures\wRK4gVHGCuBxboGlpbInBGJe.exe
                  "C:\Users\Admin\Pictures\wRK4gVHGCuBxboGlpbInBGJe.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:12608
                  • C:\Users\Admin\AppData\Local\Temp\is-145J9.tmp\wRK4gVHGCuBxboGlpbInBGJe.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-145J9.tmp\wRK4gVHGCuBxboGlpbInBGJe.tmp" /SL5="$302BC,1499526,54272,C:\Users\Admin\Pictures\wRK4gVHGCuBxboGlpbInBGJe.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:9596
                    • C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe
                      "C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe" -i
                      5⤵
                      • Executes dropped EXE
                      PID:16328
                    • C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe
                      "C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe" -s
                      5⤵
                      • Executes dropped EXE
                      PID:872
                • C:\Users\Admin\Pictures\VebtOYE0gRKq6CUIpkIgbHwB.exe
                  "C:\Users\Admin\Pictures\VebtOYE0gRKq6CUIpkIgbHwB.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:13952
                  • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                    C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:15808
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HIIIIEGHDG.exe"
                      5⤵
                        PID:13576
                        • C:\Users\Admin\AppData\Local\Temp\HIIIIEGHDG.exe
                          "C:\Users\Admin\AppData\Local\Temp\HIIIIEGHDG.exe"
                          6⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:16332
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\HIIIIEGHDG.exe
                            7⤵
                              PID:15292
                              • C:\Windows\SysWOW64\PING.EXE
                                ping 2.2.2.2 -n 1 -w 3000
                                8⤵
                                • Runs ping.exe
                                PID:9524
                      • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                        C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:17136
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:20364
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 1251
                            6⤵
                              PID:20360
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                              6⤵
                              • Creates scheduled task(s)
                              PID:20424
                      • C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe
                        "C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe" --silent --allusers=0
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Enumerates connected drives
                        • Modifies system certificate store
                        • Suspicious use of WriteProcessMemory
                        PID:6052
                        • C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe
                          C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x6df021c8,0x6df021d4,0x6df021e0
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:8936
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\IZ58qMA0IlA28BMF2DHwMPAj.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\IZ58qMA0IlA28BMF2DHwMPAj.exe" --version
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:17552
                        • C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe
                          "C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6052 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240314045531" --session-guid=22554952-7a6c-471a-87df-1010cc47ebd4 --server-tracking-blob=NjAwNjQ5YzQzMTE4MzM3MzQ5ODU5ZDVmNjA2YjhjOWYyYjM2YTMzN2FjZjMwMDQxOTU0OWQ1YmQzNTRhZDAzMjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcxMDM5MjEyMi4yMTUxIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI3YjljN2Q3OC0zMmI5LTRhYzctOTE0NC1iNzY1YmE1OTY1NzQifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=A404000000000000
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates connected drives
                          • Suspicious use of WriteProcessMemory
                          PID:18588
                          • C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe
                            C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2c0,0x2c4,0x2c8,0x290,0x2cc,0x6d1f21c8,0x6d1f21d4,0x6d1f21e0
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:20444
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
                          4⤵
                          • Executes dropped EXE
                          PID:20452
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\assistant\assistant_installer.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\assistant\assistant_installer.exe" --version
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:10040
                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\assistant\assistant_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x4f0040,0x4f004c,0x4f0058
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:15692
                  • C:\Windows\windefender.exe
                    C:\Windows\windefender.exe
                    1⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    PID:13932

                  Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Scheduled Task/Job

                  1
                  T1053

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Privilege Escalation

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Defense Evasion

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Impair Defenses

                  4
                  T1562

                  Disable or Modify System Firewall

                  1
                  T1562.004

                  Disable or Modify Tools

                  3
                  T1562.001

                  Modify Registry

                  6
                  T1112

                  Subvert Trust Controls

                  1
                  T1553

                  Install Root Certificate

                  1
                  T1553.004

                  Credential Access

                  Unsecured Credentials

                  3
                  T1552

                  Credentials In Files

                  3
                  T1552.001

                  Discovery

                  Network Service Discovery

                  2
                  T1046

                  Peripheral Device Discovery

                  1
                  T1120

                  Query Registry

                  4
                  T1012

                  Remote System Discovery

                  1
                  T1018

                  System Information Discovery

                  5
                  T1082

                  Lateral Movement

                  Collection

                  Data from Local System

                  3
                  T1005

                  Command and Control

                  Web Service

                  1
                  T1102

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\Are.docx
                    Filesize

                    11KB

                    MD5

                    a33e5b189842c5867f46566bdbf7a095

                    SHA1

                    e1c06359f6a76da90d19e8fd95e79c832edb3196

                    SHA256

                    5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                    SHA512

                    f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\IZ58qMA0IlA28BMF2DHwMPAj.exe
                    Filesize

                    640KB

                    MD5

                    8868af676a4e9f4921e04e75d11515af

                    SHA1

                    372b8e31cdd31dfa121880f35dfd85c9c039c52d

                    SHA256

                    58ba04f01b2a53723e279783ee406133bdda68eafd10e611c6542dda5ef1eea3

                    SHA512

                    225d474b6c624cad4ee641f8c5620edea11ef3f44016d88d339fd44be188b27dcea75505d943566297080894ba041482599c006331e54a803d1ca757468bbc1d

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\additional_file0.tmp
                    Filesize

                    448KB

                    MD5

                    54ffc65075d71d6b58e7acff0233991f

                    SHA1

                    dc6aa42f02c3c25335b7f9880eac98ad1a87624c

                    SHA256

                    507b0c6540fdf00a3083b4584c8c8f75592c9c58c4053930503a269414f3fffb

                    SHA512

                    1a94464736ae740bf8d568642798d1c577e6404e9b24ea567dfcb6bef99a8c9073833af0c8b33f7e6cbdc39dbc255cfd8b02f782910449e3e081aab9239c444b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                    Filesize

                    2.2MB

                    MD5

                    832e9bccc982913a449d10efce383d63

                    SHA1

                    bdbea24b47c6d274655c5ce5fa183e9a399a6d9a

                    SHA256

                    08e3bc50d776d96033d5fd8cbb7d42fabb8aeaf30c2046258369c80007ff6234

                    SHA512

                    2e4e4744b336ed928b272f2a16752c0c046c850a66c71a7e6ecac17590039ccc5db85b2476aa5bcc2adcf9f35856894a2bbf0aa37a178e3eeb9dd68ca801d5a1

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                    Filesize

                    1.8MB

                    MD5

                    12af6aa802303d11cb333038e253de9b

                    SHA1

                    bf5b85518fef17dc2211fdc284a8cbc4bbaa233a

                    SHA256

                    78d19b4878e757e39a3026664b97635495fb4f244132fca420c7bcb9f20b7162

                    SHA512

                    d48d0facea693b3764b986a12e5d1d292272f9d8831669645328f78fc69331dfcadd8a69345943faa093ecf6a11eef3db94ee33df84168199af26c6abfcfc655

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\assistant\assistant_installer.exe
                    Filesize

                    1.9MB

                    MD5

                    b3f05009b53af6435e86cfd939717e82

                    SHA1

                    770877e7c5f03e8d684984fe430bdfcc2cf41b26

                    SHA256

                    3ea8d40fcede1fc03e5603246d75d13e8d44d7229d4c390c39a55534053027f7

                    SHA512

                    d2dee80aaa79b19f1eb1db85079a05f621780e06bfea9e838b62d757ba29399f9090ec7c6ff553377c9b712f3ba8dd812cdff39f3e28829928e86746a8ac6b27

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\assistant\dbgcore.DLL
                    Filesize

                    166KB

                    MD5

                    8b6f64e5d3a608b434079e50a1277913

                    SHA1

                    03f431fabf1c99a48b449099455c1575893d9f32

                    SHA256

                    926d444ffca166e006920412677c4ed2ef159cf0efc0578cb45b824f428f5eb2

                    SHA512

                    c9aeac62ece564ac64a894300fb9d41d13f22951ead73421854c23c506760d984dff0af92bef2d80f3a66e782f0075832e9c24a50ae6110d27a25c14e065b41c

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\opera_package
                    Filesize

                    10.1MB

                    MD5

                    59b258d4f936d5131e27e69ee606e772

                    SHA1

                    6ad61b9b0cbca3dcfcec7f70d6bb45401b094421

                    SHA256

                    c487ada0e9d0a37cdd2cb34061a89f39ac4e9d9289a5d92164a2212ddb0e161f

                    SHA512

                    fcec25605c6d3d839ffd2c04ce6a88eff5213a1ed53209c3ed38e1d676551261bd209179438ffa9b6c6b429a86e2a3d54461623b1aa1923e4e65559095a8e6de

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                    Filesize

                    1.7MB

                    MD5

                    eee5ddcffbed16222cac0a1b4e2e466e

                    SHA1

                    28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

                    SHA256

                    2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

                    SHA512

                    8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\HIIIIEGHDG.exe
                    Filesize

                    101KB

                    MD5

                    42b838cf8bdf67400525e128d917f6e0

                    SHA1

                    a578f6faec738912dba8c41e7abe1502c46d0cae

                    SHA256

                    0e4ffba62ce9a464aa1b7ff9f1e55ace8f51ff1e15102d856f801a81f8b4607d

                    SHA512

                    f64b39d885375251ab7db72c57dc5b5095f0c6412169f1035d1f6a25b8415a2a01004d06bfa0267cf683ef7dea7a9f969ad43fde5a4376f1fcb65a57403433c0

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_24031404553073617552.dll
                    Filesize

                    640KB

                    MD5

                    b1becd25a34dd27c5e70b9af9a256a58

                    SHA1

                    74789a552d4a278f65af389de6e9f68ab68aa54d

                    SHA256

                    5c0d03167fc27f9561cb491bfbac707bd2e1b08bc308395843c6a36a3f06fa05

                    SHA512

                    9fbe8151aa43fb9caff885680dc16e8c5642a6f91785b7cead658affd64aa033244ea4abf54baa32502197f17ff9c951c0b266564037e1eadf04156a4b955056

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1qrzm2bq.nzw.ps1
                    Filesize

                    1B

                    MD5

                    c4ca4238a0b923820dcc509a6f75849b

                    SHA1

                    356a192b7913b04c54574d18c28d46e6395428ab

                    SHA256

                    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                    SHA512

                    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    Filesize

                    281KB

                    MD5

                    d98e33b66343e7c96158444127a117f6

                    SHA1

                    bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                    SHA256

                    5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                    SHA512

                    705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\is-145J9.tmp\wRK4gVHGCuBxboGlpbInBGJe.tmp
                    Filesize

                    677KB

                    MD5

                    33da9dc521f467c0405d3ef5377ce04b

                    SHA1

                    5249d7ce5dfabe5ee6d2fc7d3f3eba1e866b7d1f

                    SHA256

                    dbab8a7b2b45fc7001d5e34d3d45ccbe93a7591f12910281acf2c32f8c4e631c

                    SHA512

                    a3093637e1d731eab58080e10706db1afbf6e79fbac6593733b61033f97875ecbe230311e9741d349625ec3a66a6435318846d35290db8cd00af76d692699a55

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                    Filesize

                    279KB

                    MD5

                    7216e65c0d8a0caa4fbbbe527310a02b

                    SHA1

                    0d8e464d91d6b7408e0249d8abf555e6a7f7df87

                    SHA256

                    96223286733a4e9fb3bccd32154d64448aeacdee58147455601f9826ce749f75

                    SHA512

                    fb99567d73a53b21cfb1d4000dd70e729765c9de557eb1fdc74c44628c084ddaacf59eac4428aedde0400ddeb1b1d2950d4c83a282ecfeed475af89046aad54f

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe
                    Filesize

                    1.4MB

                    MD5

                    38d0a0e28eeeeaafb1028718df3e86e4

                    SHA1

                    dbb358ab4dcdad30c6b630d5ae86356612c8398f

                    SHA256

                    a12100ce66060498ca33a2a67854b1efa7d51ecc6f6126cd712350d7fe60d185

                    SHA512

                    76fde4900a7540c73518536ac6442c6583a12efcd7d0a706baa495249c633b51e59b1063722e597d9956e6deecfe635d4d6091580584daf96c87ddecd32edc70

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe
                    Filesize

                    1.7MB

                    MD5

                    bfad48ff26556700235d2be3046b40fb

                    SHA1

                    b252b3711653cdd91b3b1e120639ac068ce0d1c3

                    SHA256

                    1656175f9120eeb82f62b08cddbf703c70f474967c5b452848d95634efb041b3

                    SHA512

                    d17bc42060109815d8161bdd6fb18ce5e5c7e5c7353329f9e67205e25c3a1d8d6af532bbc060d4cd69d98ebb3f9635558c9b7e3b586b52640c873b4238e34603

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                    Filesize

                    40B

                    MD5

                    6c40a4928e9aa1e3d8435f3f13035f74

                    SHA1

                    f9d2ad8d25fc2b40884240375fea18dd567ee419

                    SHA256

                    daa95557ada677f8de80cd60028603b486a661faa786e04476a34e2406724f9f

                    SHA512

                    0eacf926ca68c415df980e6ec0d538b38d461dac367878ed654f1301f2be697b28b075d878c78b874e67b5a0127cbe9e9370265f3d8fc614c77d077880ace91c

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                    Filesize

                    128B

                    MD5

                    11bb3db51f701d4e42d3287f71a6a43e

                    SHA1

                    63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                    SHA256

                    6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                    SHA512

                    907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                    Download Submit

                  • C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe
                    Filesize

                    2.2MB

                    MD5

                    3b3014f215e0f14f259145641489fb3a

                    SHA1

                    85ad34eb79a7370fafea28d241ce1bedbe5076fe

                    SHA256

                    63aa743abf6a2312bf3f7c966587933cba6f547d54e79e245bac262b137d3b69

                    SHA512

                    57174bb68286d00fa761b6015effa4fa1429be76af5f9d2e037db506217027a8b9c5e3c1f366701bc15ab597ab4f807c5c19e8490443357baa5db0158fa3039a

                    Download Submit

                  • C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe
                    Filesize

                    1.5MB

                    MD5

                    77939436ed260ef5c1d37bb230830bfc

                    SHA1

                    68227c5ae3772c3489f5762cdc6b71e7e0a0a85d

                    SHA256

                    28ccbcdb612a0217ce8ba440074d06b1de7efcf9e8c64b11a66fd4336b8f20e8

                    SHA512

                    6da5d9a947e446d5b453a91aff029c64d8af06afd9f3615fcf8cdfcd7e1e824daf20f0b5c46dea3fb02a5cd63594907630e6e40357c4a1a17349d59e4c793412

                    Download Submit

                  • C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe
                    Filesize

                    1.8MB

                    MD5

                    aa9b9dff93149fd5be61553980565107

                    SHA1

                    db4ab8991a833927b7a6b426a8f7c0266c2caf75

                    SHA256

                    44ee86f2af3b9d03b2f55384405ccda09018a3c9a121ce5cb6fd2affb1f1a589

                    SHA512

                    69f2a5d6105c7a12676310fd236597945daeedf803efab426281d6244775fd819f3c5994b5c5be71c5fc61c5d11565558d5bc576c8c71579a32c9833ff60a293

                    Download Submit

                  • C:\Users\Admin\Pictures\IZ58qMA0IlA28BMF2DHwMPAj.exe
                    Filesize

                    2.8MB

                    MD5

                    e739fe9a83a8983e98bcdf5fd687ce6e

                    SHA1

                    1c2467659e34a38e3fb24bc2ba1af461bd230c74

                    SHA256

                    7c5bcdb9ebd284559a2d9b4923ef526402b6fc5bfc1ce2677729dfab0e333820

                    SHA512

                    25684d54a6c7d334ab0981c1a0522bce8f045c4fea2e09b5a63fdffd554bf2c71ea14686c235e15287b191b14865147500bf6ed678079d858ee593302f97d23b

                    Download Submit

                  • C:\Users\Admin\Pictures\LpRhF8jaeig6QHkQ4x7HDip6.exe
                    Filesize

                    4.2MB

                    MD5

                    5a0739008071b694a7cf8cf96335de16

                    SHA1

                    e8b3fbde04993c12226ce67df3d0574ebdfef28a

                    SHA256

                    03b7793894b39f93b75ced9f0dc7ec9ba79ebdd1a6df5b725121acbfca1b2e14

                    SHA512

                    cd0d681d3702389b1f8db13a7274b0316e44fc5e9fd3a437742b3533c58fe1d7153f3e5b4287a00eb9beb009e563cabd44877dd03727c4274155b113e6dd7b48

                    Download Submit

                  • C:\Users\Admin\Pictures\LpRhF8jaeig6QHkQ4x7HDip6.exe
                    Filesize

                    297KB

                    MD5

                    49e0eb9e44d205f349724698e2b2442e

                    SHA1

                    44a3cd5acd0bc5d31c669bcf3f787d511ccfceb2

                    SHA256

                    afeb2402b214aec0c81548844f93859f70d977edf343641efbb0f6df793f8722

                    SHA512

                    06dd6c2bfec0fac9d33bda3d7551e4c62ad22bde71875215fb50ed59204b7653e47724bec187c8a63887f044c841e050729b94a9c7be0a1db1a3fdd1af1a43f0

                    Download Submit

                  • C:\Users\Admin\Pictures\LpRhF8jaeig6QHkQ4x7HDip6.exe
                    Filesize

                    320KB

                    MD5

                    bc65685c16a2cba7cd03aafa8726fa8d

                    SHA1

                    1775d8c21e4e973c4423eb130f4f442bffb5b6c4

                    SHA256

                    3b5bc4de2de4b403c3ad73c66a81275001e3599656e3a44f3813f287009fb82d

                    SHA512

                    4c159407b8a716a706c6e46b290909e46f584084f3d17cc827b52302b17bb29c993e9b774c35d02b8edb5de437843f3deae4acfda2dd9fa425c02cdde09ff3c3

                    Download Submit

                  • C:\Users\Admin\Pictures\VebtOYE0gRKq6CUIpkIgbHwB.exe
                    Filesize

                    2.1MB

                    MD5

                    d83fb2086d717f34e470f98e8334a9d4

                    SHA1

                    38bff127679ad65073e02a3d5d4a0c826a2018c7

                    SHA256

                    49fe8630d3a4c0315c89b72f886729bd5bd0dca567c52da14bbdc60335ad5e48

                    SHA512

                    24ed396f719fde0b619463631d85862f97374ffa91e31ac143fc9986124497c960fef3b60571b4714f796bb90a53b182033273f5e1e15f331c471b8c12068bba

                    Download Submit

                  • C:\Users\Admin\Pictures\v45Od9BWuND2VtFIWQMklpQY.exe
                    Filesize

                    7KB

                    MD5

                    5b423612b36cde7f2745455c5dd82577

                    SHA1

                    0187c7c80743b44e9e0c193e993294e3b969cc3d

                    SHA256

                    e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                    SHA512

                    c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                    Download Submit

                  • C:\Users\Admin\Pictures\wRK4gVHGCuBxboGlpbInBGJe.exe
                    Filesize

                    14KB

                    MD5

                    1b70c065768ca900d60b0a7306b10a7a

                    SHA1

                    10ba2336ba5ee698bd20d6cd22c333bc109e8edd

                    SHA256

                    67259af0c810b1fc6bc34b5df428c9964fcf76dcd8d6e46a85d42d9b92dacbae

                    SHA512

                    f19356b296524d432fa72a21138ec4a5244bb3478d24b5ce9f8a027b44e37482f8aaa59b7e4a7acad15d96cc44c8ba28336c16fe111733918e9bb8b157594eb3

                    Download Submit

                  • C:\Users\Admin\Pictures\wRK4gVHGCuBxboGlpbInBGJe.exe
                    Filesize

                    1.8MB

                    MD5

                    c7ea06c410960a3dc96038e5cf64ec39

                    SHA1

                    685412972821f239938381f27e5572fbe4fa6ead

                    SHA256

                    a4e10aeac8a7c3f4df0afcd24b210ae0b74c4966f5b78ff1a73de74165f02b8d

                    SHA512

                    0af2dffb7e5e8f268f04b272bed041197a0f43392f9c99909bbc17851bdfa9df88634d55b678e825571a259473e748820259382e90ee3cd5ee1e5a79cbcf6711

                    Download Submit

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                    Filesize

                    2KB

                    MD5

                    1c19c16e21c97ed42d5beabc93391fc5

                    SHA1

                    8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                    SHA256

                    1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                    SHA512

                    7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                    Download Submit

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    Filesize

                    18KB

                    MD5

                    252757a018ad85cb4b8d3cb177e9e1ab

                    SHA1

                    30d1a8e7d63979af13d84120791844996f795e0c

                    SHA256

                    73ad30dcba24a25e5d6d0f0882326515b79c9c06023f16acb937a2b12b138f22

                    SHA512

                    5782fd09608a314142df7b13ac75f2d1980902d18f3f90b555cdd62c89e6f1b3f033ed6b1cfc48d6c103742d21ac645cb1cfd212220cb59a8bd14767620cbfcd

                    Download Submit

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    Filesize

                    18KB

                    MD5

                    8a45608689c4b5c8b5d3c02b408e6c86

                    SHA1

                    b072818c66f4a432d1a13abbae01352887008d16

                    SHA256

                    b3fab18e93347809c8556ec3cd84746f18f4754b887c4ef469ca00086435789a

                    SHA512

                    3450391ba6d1e45d8a755ef15d23ac678e3b33ec2d00aabdfac978392093d93b7b18a0c5b6b4d5a7730862648f9576c015a2b3229c550582e3d52677e61232d2

                    Download Submit

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    Filesize

                    18KB

                    MD5

                    b8298281b7a3bd8a18fb1a89fed2a49c

                    SHA1

                    976476507d31ced5a3adda953c859708606f4071

                    SHA256

                    37b55a12ffafaffab4c7ae887f6675531a581027f328961cc27226a9c7972c3f

                    SHA512

                    0bd280fb59e7f02ea5c061931805778a39bfaea035080866c16d2f3b9d10650ca337516a5679b14a1568b6403424e19a50712d665fc48062ccfad9dc13b0a305

                    Download Submit

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    Filesize

                    18KB

                    MD5

                    344f89cf79be626bf1697896d740fc7c

                    SHA1

                    243c1b8272499fd09640ba3373ae8706415af0fd

                    SHA256

                    0ad597c904ea51599f54dbf066118cb1a535609b3828a19c8450c9874d241fd6

                    SHA512

                    99520e74c2cccec886517aee6d649c999dcb3aaa6602cfa809abbc7c9a981d21544c5f980d393741066f174335afead8a657a4fed2f41ed575db0d723a1ee62f

                    Download Submit

                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                    Filesize

                    18KB

                    MD5

                    efce0b96fa6b86f1f7bac264f463327f

                    SHA1

                    a35559b60ed4f618457b497ef787aefd88fcca0f

                    SHA256

                    ee3c0a24ade8ff9fe5090a7e684345e66cd67238be1918f5533b441e875807cb

                    SHA512

                    347552e868d87179296c54810bef826b5e032916fff26467d47f26748ef03084be43f70320e05e8f38ba4151ea348117cc1e5241a8353413a8e8c50c045f12ce

                    Download Submit

                  • C:\Windows\windefender.exe
                    Filesize

                    2.0MB

                    MD5

                    8e67f58837092385dcf01e8a2b4f5783

                    SHA1

                    012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                    SHA256

                    166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                    SHA512

                    40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                    Download Submit

                  • \ProgramData\mozglue.dll
                    Filesize

                    593KB

                    MD5

                    c8fd9be83bc728cc04beffafc2907fe9

                    SHA1

                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                    SHA256

                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                    SHA512

                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                    Download Submit

                  • \ProgramData\nss3.dll
                    Filesize

                    2.0MB

                    MD5

                    1cc453cdf74f31e4d913ff9c10acdde2

                    SHA1

                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                    SHA256

                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                    SHA512

                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403140455311\assistant\dbghelp.dll
                    Filesize

                    1.7MB

                    MD5

                    925ea07f594d3fce3f73ede370d92ef7

                    SHA1

                    f67ea921368c288a9d3728158c3f80213d89d7c2

                    SHA256

                    6d02ebd4ec9a6093f21cd8ccefb9445fa0ab7b1f69ac868a5cfc5d28ed8d2de9

                    SHA512

                    a809851da820d9fdd8fb860a8f549311dcc2579df2c6f6fba74f50d5d8bf94baa834b09fb5476ac248f18d1deb6b47d4fdd6d658889d5d45ca8774a9264483d2

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\Opera_installer_2403140455289346052.dll
                    Filesize

                    960KB

                    MD5

                    b6b83c45d5230b1cb9ca50273aea8afa

                    SHA1

                    f69bfe3e35a878c7d70f26f6c9622bd712585c8b

                    SHA256

                    adfecad074a9ec65fdad2e44ec1efc8980e73575d0196e969c18aea33a6a3af1

                    SHA512

                    4d61d0e181107050356d33f169accf536a3aa2e80bc8a9e5de8ed05962c53fc6a90ab938fb21938d3a7718a4bab9cb170e113ccff6314f8a6e24299a1e319dc0

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\Opera_installer_2403140455291508936.dll
                    Filesize

                    512KB

                    MD5

                    edcabf3acb09e79b542436c67624d50b

                    SHA1

                    c36b51cd4ff8d95586e4665e64fc611c3c043425

                    SHA256

                    e2eebe087ade661f6d17f8765a231b8e4a107bbe7b38200c5dd50de142b85347

                    SHA512

                    e2103a1f4bdf2bbf7b383785d1aba6294e698961f3cf87629962f35abc115573f842016802adddce7fa65c9e803a63b2717cc1a83bf9fd1b71e05132cc674953

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\Opera_installer_24031404553073617552.dll
                    Filesize

                    576KB

                    MD5

                    6585c04ac560776fa8dd6c2b85350b1f

                    SHA1

                    27b918c549a7e0cd3129b2a51f8451ab244f3429

                    SHA256

                    13624a80c9de106952e6315f00102bf44bfe2ce6192550e3a872d9c223212ef4

                    SHA512

                    9a40c9a11371b2dcb35a197c78cc991f269f897e281be1c4becbb2d90682b584644dbe367a701d114cfcc742fc4ba34910ff2691e712695986c0983526572bdd

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\Opera_installer_24031404553564818588.dll
                    Filesize

                    4.6MB

                    MD5

                    fdeb4d1d95a738ba8882988a97a12d32

                    SHA1

                    42dd25cae583521aa96a02b5135bba6fde9ac3fb

                    SHA256

                    1c52520c6d2398a266245a1d29fcf5b58ff7bb8f7ecf8868898bab7bcad37d6e

                    SHA512

                    4cb87510d4612a36c83543ca58a17469aa8aaee569481c121d2d70a7923d7174efbdcede18342f49bb26aa0bbcd44b58630697ef54986aa5efbf2b3920ef33cf

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\is-CS1UF.tmp\_isetup\_iscrypt.dll
                    Filesize

                    2KB

                    MD5

                    a69559718ab506675e907fe49deb71e9

                    SHA1

                    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                    SHA256

                    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                    SHA512

                    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nsxF204.tmp\INetC.dll
                    Filesize

                    21KB

                    MD5

                    2b342079303895c50af8040a91f30f71

                    SHA1

                    b11335e1cb8356d9c337cb89fe81d669a69de17e

                    SHA256

                    2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

                    SHA512

                    550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

                    Download Submit

                  • memory/872-654-0x0000000000400000-0x00000000005AA000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/872-366-0x0000000000400000-0x00000000005AA000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/872-170-0x0000000000400000-0x00000000005AA000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/872-271-0x0000000000400000-0x00000000005AA000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/872-164-0x0000000000400000-0x00000000005AA000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/872-375-0x0000000000400000-0x00000000005AA000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/872-915-0x0000000000400000-0x00000000005AA000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/4672-2-0x0000017955E90000-0x0000017955EA0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/4672-7-0x000001795C1D0000-0x000001795C22C000-memory.dmp

                    Filesize

                    368KB

                    Download

                  • memory/4672-1-0x00007FFCE0350000-0x00007FFCE0D3C000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/4672-0-0x000001793B850000-0x000001793B85E000-memory.dmp

                    Filesize

                    56KB

                    Download

                  • memory/4672-15-0x00007FFCE0350000-0x00007FFCE0D3C000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/4672-33-0x0000017955E90000-0x0000017955EA0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/6052-175-0x0000000001150000-0x0000000001688000-memory.dmp

                    Filesize

                    5.2MB

                    Download

                  • memory/6052-273-0x0000000001150000-0x0000000001688000-memory.dmp

                    Filesize

                    5.2MB

                    Download

                  • memory/8936-189-0x0000000001150000-0x0000000001688000-memory.dmp

                    Filesize

                    5.2MB

                    Download

                  • memory/9196-20-0x000001ECE86F0000-0x000001ECE8766000-memory.dmp

                    Filesize

                    472KB

                    Download

                  • memory/9196-11-0x00007FFCE0350000-0x00007FFCE0D3C000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/9196-69-0x00007FFCE0350000-0x00007FFCE0D3C000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/9196-16-0x000001ECE8460000-0x000001ECE8470000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/9196-65-0x000001ECE8460000-0x000001ECE8470000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/9196-13-0x000001ECE8460000-0x000001ECE8470000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/9196-14-0x000001ECE8420000-0x000001ECE8442000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/9196-36-0x000001ECE8460000-0x000001ECE8470000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/9472-944-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/9596-201-0x00000000001F0000-0x00000000001F1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/9596-239-0x0000000000400000-0x00000000004B8000-memory.dmp

                    Filesize

                    736KB

                    Download

                  • memory/9596-109-0x00000000001F0000-0x00000000001F1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/12300-653-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/12300-205-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/12300-185-0x0000000002860000-0x0000000002C5F000-memory.dmp

                    Filesize

                    4.0MB

                    Download

                  • memory/12300-217-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/12300-484-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/12300-91-0x0000000002860000-0x0000000002C5F000-memory.dmp

                    Filesize

                    4.0MB

                    Download

                  • memory/12300-361-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/12300-99-0x0000000002D60000-0x000000000364B000-memory.dmp

                    Filesize

                    8.9MB

                    Download

                  • memory/12300-187-0x0000000002D60000-0x000000000364B000-memory.dmp

                    Filesize

                    8.9MB

                    Download

                  • memory/12300-110-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/12608-173-0x0000000000400000-0x0000000000414000-memory.dmp

                    Filesize

                    80KB

                    Download

                  • memory/12608-85-0x0000000000400000-0x0000000000414000-memory.dmp

                    Filesize

                    80KB

                    Download

                  • memory/13952-199-0x0000000000400000-0x000000000043D000-memory.dmp

                    Filesize

                    244KB

                    Download

                  • memory/15808-374-0x0000000000400000-0x0000000000720000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/15808-211-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                    Filesize

                    972KB

                    Download

                  • memory/15808-274-0x0000000000840000-0x0000000000940000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/15808-586-0x0000000000400000-0x0000000000720000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/15808-270-0x0000000000400000-0x0000000000720000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/15808-247-0x00000000007B0000-0x00000000007D7000-memory.dmp

                    Filesize

                    156KB

                    Download

                  • memory/15808-279-0x0000000000400000-0x0000000000720000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/15808-163-0x0000000000400000-0x0000000000720000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/15808-160-0x0000000000840000-0x0000000000940000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/15808-159-0x00000000007B0000-0x00000000007D7000-memory.dmp

                    Filesize

                    156KB

                    Download

                  • memory/16328-157-0x0000000000400000-0x00000000005AA000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/16328-147-0x0000000000400000-0x00000000005AA000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/16328-146-0x0000000000400000-0x00000000005AA000-memory.dmp

                    Filesize

                    1.7MB

                    Download

                  • memory/16828-158-0x00000000732C0000-0x00000000739AE000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/16828-161-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/16828-35-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/16828-21-0x00000000732C0000-0x00000000739AE000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/16828-18-0x0000000000400000-0x0000000000408000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/17136-203-0x0000000000400000-0x0000000000930000-memory.dmp

                    Filesize

                    5.2MB

                    Download

                  • memory/17136-295-0x0000000000400000-0x0000000000930000-memory.dmp

                    Filesize

                    5.2MB

                    Download

                  • memory/17136-208-0x00000000026B0000-0x00000000026B1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/17552-214-0x0000000000DA0000-0x00000000012D8000-memory.dmp

                    Filesize

                    5.2MB

                    Download

                  • memory/17552-215-0x0000000000DA0000-0x00000000012D8000-memory.dmp

                    Filesize

                    5.2MB

                    Download

                  • memory/18588-245-0x0000000001150000-0x0000000001688000-memory.dmp

                    Filesize

                    5.2MB

                    Download

                  • memory/20332-272-0x0000000006A20000-0x0000000006A56000-memory.dmp

                    Filesize

                    216KB

                    Download

                  • memory/20332-376-0x0000000009E90000-0x0000000009EC3000-memory.dmp

                    Filesize

                    204KB

                    Download

                  • memory/20332-379-0x000000006C560000-0x000000006C8B0000-memory.dmp

                    Filesize

                    3.3MB

                    Download

                  • memory/20332-294-0x0000000007870000-0x00000000078D6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/20332-378-0x000000006C510000-0x000000006C55B000-memory.dmp

                    Filesize

                    300KB

                    Download

                  • memory/20332-380-0x0000000009E50000-0x0000000009E6E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/20332-377-0x000000007F800000-0x000000007F810000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/20332-280-0x0000000007120000-0x0000000007748000-memory.dmp

                    Filesize

                    6.2MB

                    Download

                  • memory/20332-287-0x0000000006AE0000-0x0000000006AF0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/20332-385-0x0000000009ED0000-0x0000000009F75000-memory.dmp

                    Filesize

                    660KB

                    Download

                  • memory/20332-286-0x00000000732C0000-0x00000000739AE000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/20332-387-0x0000000006AE0000-0x0000000006AF0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/20332-288-0x0000000006AE0000-0x0000000006AF0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/20332-297-0x0000000007B60000-0x0000000007EB0000-memory.dmp

                    Filesize

                    3.3MB

                    Download

                  • memory/20332-292-0x0000000007020000-0x0000000007042000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/20332-364-0x00000000090A0000-0x0000000009116000-memory.dmp

                    Filesize

                    472KB

                    Download

                  • memory/20332-293-0x0000000007750000-0x00000000077B6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/20332-330-0x0000000008480000-0x00000000084BC000-memory.dmp

                    Filesize

                    240KB

                    Download

                  • memory/20332-308-0x0000000008210000-0x000000000825B000-memory.dmp

                    Filesize

                    300KB

                    Download

                  • memory/20332-307-0x0000000007EB0000-0x0000000007ECC000-memory.dmp

                    Filesize

                    112KB

                    Download

                  • memory/20444-371-0x0000000001150000-0x0000000001688000-memory.dmp

                    Filesize

                    5.2MB

                    Download

                  • memory/20444-252-0x0000000001150000-0x0000000001688000-memory.dmp

                    Filesize

                    5.2MB

                    Download