Overview

overview

10

Static

static

1

dfe244414c...b6.exe

windows7-x64

1

dfe244414c...b6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 09:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dfe244414c8461175241ce54707eb6b6.exe

  • Size

    405KB

  • MD5

    dfe244414c8461175241ce54707eb6b6

  • SHA1

    1c94e583b7058d01dad42d56ef5ddf17b64b5778

  • SHA256

    6b7baa1db0d2ed5c12dfb8f289449384ff821110f9b490379c5fcd9190090f4e

  • SHA512

    a8b872308f2e4d51bf99617bad931117921a4332d2a4b2e84c6e45bf42829999a95883b146dca93894ffbd5bcd0f03cb682468457ac2ff1cefcb43155f4225c9

  • SSDEEP

    12288:eN6XS66ZeKgLaIGVkwpU0uNqFrNNkpICQzlG:26CNe0IGVl+qHul

Score
10/10
gluptebastealcdiscoverydropperevasionloaderpersistencerootkitspywarestealerthemidatrojanupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 16 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 8 IoCs
  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 8 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 14 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 9 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\dfe244414c8461175241ce54707eb6b6.exe
    "C:\Users\Admin\AppData\Local\Temp\dfe244414c8461175241ce54707eb6b6.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Checks computer location settings
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\dfe244414c8461175241ce54707eb6b6.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1188
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Users\Admin\Pictures\Fdme3Tu8iZv2WMfiE0EcNHfd.exe
        "C:\Users\Admin\Pictures\Fdme3Tu8iZv2WMfiE0EcNHfd.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:548
        • C:\Users\Admin\AppData\Local\Temp\uf8.0.exe
          "C:\Users\Admin\AppData\Local\Temp\uf8.0.exe"
          4⤵
          • Executes dropped EXE
          PID:1152
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 1040
            5⤵
            • Program crash
            PID:3556
        • C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
          "C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4136
          • C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
            C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:4468
            • C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
              C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetWindowsHookEx
              PID:5532
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\SysWOW64\cmd.exe
                7⤵
                • Drops file in Windows directory
                PID:5360
      • C:\Users\Admin\Pictures\IyV7gPo8ohrWhtnDyz03tACU.exe
        "C:\Users\Admin\Pictures\IyV7gPo8ohrWhtnDyz03tACU.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3328
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:224
        • C:\Users\Admin\Pictures\IyV7gPo8ohrWhtnDyz03tACU.exe
          "C:\Users\Admin\Pictures\IyV7gPo8ohrWhtnDyz03tACU.exe"
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3056
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:640
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
              PID:4892
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:1488
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:212
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4336
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                6⤵
                  PID:1152
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe
                5⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Manipulates WinMonFS driver.
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5192
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  6⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5284
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  6⤵
                  • Creates scheduled task(s)
                  PID:5540
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /delete /tn ScheduledUpdate /f
                  6⤵
                    PID:5560
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5584
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5888
                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                    6⤵
                    • Executes dropped EXE
                    PID:4892
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    6⤵
                    • Creates scheduled task(s)
                    PID:5280
                  • C:\Windows\windefender.exe
                    "C:\Windows\windefender.exe"
                    6⤵
                    • Executes dropped EXE
                    PID:3320
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      7⤵
                        PID:5516
                        • C:\Windows\SysWOW64\sc.exe
                          sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          8⤵
                          • Launches sc.exe
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3332
              • C:\Users\Admin\Pictures\XHZE6XPpDYmmijt8QGIwAdbO.exe
                "C:\Users\Admin\Pictures\XHZE6XPpDYmmijt8QGIwAdbO.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5096
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1772
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 2564
                    5⤵
                    • Program crash
                    PID:2344
                • C:\Users\Admin\Pictures\XHZE6XPpDYmmijt8QGIwAdbO.exe
                  "C:\Users\Admin\Pictures\XHZE6XPpDYmmijt8QGIwAdbO.exe"
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1436
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4632
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4280
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:4464
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3232
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1228
              • C:\Users\Admin\Pictures\4uBfhilwjdlkKrb1TSCCuwRe.exe
                "C:\Users\Admin\Pictures\4uBfhilwjdlkKrb1TSCCuwRe.exe"
                3⤵
                • Modifies firewall policy service
                • Windows security bypass
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in System32 directory
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:1448
              • C:\Users\Admin\Pictures\55dX5nybY74bBVYSEWX4v4JA.exe
                "C:\Users\Admin\Pictures\55dX5nybY74bBVYSEWX4v4JA.exe"
                3⤵
                • Executes dropped EXE
                PID:2008
                • C:\Users\Admin\AppData\Local\Temp\7zS209E.tmp\Install.exe
                  .\Install.exe /nxdidQZJ "385118" /S
                  4⤵
                  • Checks BIOS information in registry
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:5552
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    5⤵
                      PID:5036
                      • C:\Windows\SysWOW64\cmd.exe
                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        6⤵
                          PID:5728
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                            7⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5736
                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                              8⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:428
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 09:56:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\ROgyVeu.exe\" em /Dksite_idsVB 385118 /S" /V1 /F
                        5⤵
                        • Drops file in Windows directory
                        • Creates scheduled task(s)
                        PID:4480
                  • C:\Users\Admin\Pictures\KiL20IV7W2j3whVhoIQuT0wU.exe
                    "C:\Users\Admin\Pictures\KiL20IV7W2j3whVhoIQuT0wU.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:2068
                    • C:\Users\Admin\AppData\Local\Temp\7zS402C.tmp\Install.exe
                      .\Install.exe /nxdidQZJ "385118" /S
                      4⤵
                      • Checks BIOS information in registry
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:6136
                      • C:\Windows\SysWOW64\forfiles.exe
                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                        5⤵
                          PID:5948
                          • C:\Windows\SysWOW64\cmd.exe
                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                            6⤵
                              PID:2484
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                7⤵
                                  PID:2956
                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                    8⤵
                                      PID:6040
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 09:56:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\UpMjCtr.exe\" em /Utsite_idARy 385118 /S" /V1 /F
                                5⤵
                                • Drops file in Windows directory
                                • Creates scheduled task(s)
                                PID:5512
                          • C:\Users\Admin\Pictures\7mmV2mgNZZRKBeZ3CX2aTL6F.exe
                            "C:\Users\Admin\Pictures\7mmV2mgNZZRKBeZ3CX2aTL6F.exe" --silent --allusers=0
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Enumerates connected drives
                            PID:208
                            • C:\Users\Admin\Pictures\7mmV2mgNZZRKBeZ3CX2aTL6F.exe
                              C:\Users\Admin\Pictures\7mmV2mgNZZRKBeZ3CX2aTL6F.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a8,0x2ac,0x2b0,0x284,0x2b4,0x6fc2e1d0,0x6fc2e1dc,0x6fc2e1e8
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:5136
                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\7mmV2mgNZZRKBeZ3CX2aTL6F.exe
                              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\7mmV2mgNZZRKBeZ3CX2aTL6F.exe" --version
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:4880
                            • C:\Users\Admin\Pictures\7mmV2mgNZZRKBeZ3CX2aTL6F.exe
                              "C:\Users\Admin\Pictures\7mmV2mgNZZRKBeZ3CX2aTL6F.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=208 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240420095528" --session-guid=16f521e5-d503-4113-b8b5-5d21dc171159 --server-tracking-blob="N2M4ODA2ZWU1MTQ0MDIwZGRmNjBhMDIzN2FhMmIzY2NhNzRkYjY5MDQ2ZjZjN2I0YWZlOWYwNGFhNWM1NDVkNzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fMTIzIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzNjA2NzkwLjY3MTMiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzEyMyIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiNTk0NzRmNDEtYTI3Mi00YzQwLWIxNjItN2VmYTBlYzVkMTczIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=8005000000000000
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Enumerates connected drives
                              PID:744
                              • C:\Users\Admin\Pictures\7mmV2mgNZZRKBeZ3CX2aTL6F.exe
                                C:\Users\Admin\Pictures\7mmV2mgNZZRKBeZ3CX2aTL6F.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6ed0e1d0,0x6ed0e1dc,0x6ed0e1e8
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:3112
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                          2⤵
                            PID:1556
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1152 -ip 1152
                          1⤵
                            PID:4336
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                            1⤵
                              PID:3256
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                              1⤵
                                PID:392
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1772 -ip 1772
                                1⤵
                                  PID:2336
                                • C:\Windows\windefender.exe
                                  C:\Windows\windefender.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  PID:4620

                                Network

                                MITRE ATT&CK Enterprise v15

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Scheduled Task/Job

                                1
                                T1053

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                2
                                T1543

                                Windows Service

                                2
                                T1543.003

                                Scheduled Task/Job

                                1
                                T1053

                                Privilege Escalation

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                2
                                T1543

                                Windows Service

                                2
                                T1543.003

                                Scheduled Task/Job

                                1
                                T1053

                                Defense Evasion

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Impair Defenses

                                4
                                T1562

                                Disable or Modify System Firewall

                                1
                                T1562.004

                                Disable or Modify Tools

                                3
                                T1562.001

                                Modify Registry

                                6
                                T1112

                                Virtualization/Sandbox Evasion

                                1
                                T1497

                                Credential Access

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Peripheral Device Discovery

                                1
                                T1120

                                Query Registry

                                7
                                T1012

                                System Information Discovery

                                7
                                T1082

                                Virtualization/Sandbox Evasion

                                1
                                T1497

                                Lateral Movement

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Web Service

                                1
                                T1102

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                  Filesize

                                  2KB

                                  MD5

                                  a6ea7bfcd3aac150c0caef765cb52281

                                  SHA1

                                  037dc22c46a0eb0b9ad4c74088129e387cffe96b

                                  SHA256

                                  f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9

                                  SHA512

                                  c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  Filesize

                                  944B

                                  MD5

                                  6d3e9c29fe44e90aae6ed30ccf799ca8

                                  SHA1

                                  c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                  SHA256

                                  2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                  SHA512

                                  60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  Filesize

                                  11KB

                                  MD5

                                  fd8d3044464b8387c36d088c8b8a9d6f

                                  SHA1

                                  b724bb1c9fbfcc1282c7360245161025695bc309

                                  SHA256

                                  d6cbd711a15f48efd033de59e751d6bbbd975efd8355dd750d829760bfbdb2c3

                                  SHA512

                                  8e14d0f763931861e4738cdc4ea02f1b3c21a945cc4163d84ee3a1e0723d9262d5d48ee8a9c910c620889ab07814139ea35ddfdddd5d00ade23ee250524b1754

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\5ee5006a
                                  Filesize

                                  5.9MB

                                  MD5

                                  dcc26dd014bad9eafa9066d3781b615d

                                  SHA1

                                  b0cb8621ca58a196ac73bed4e525deacfaf2d836

                                  SHA256

                                  69502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3

                                  SHA512

                                  5a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\6ab1d3d4
                                  Filesize

                                  1.4MB

                                  MD5

                                  c7a2e3ab9a9d52c341c5442b55f79f3d

                                  SHA1

                                  953b445877c8973414a348d9ca4bfdc2470e500f

                                  SHA256

                                  b6c180c52b582b49ea41885e860da3a4407f2d8a20f1da08eff9106c6ce61560

                                  SHA512

                                  463a9f3c977f16dc4c36c6f6a9d03448b27f034461fe72d3965bfcf2c852cad8e769f8ee538cabab622cca4888e5a5515256cb185f08d58f0f7b8fef9eab6294

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\7zS209E.tmp\Install.exe
                                  Filesize

                                  6.8MB

                                  MD5

                                  e77964e011d8880eae95422769249ca4

                                  SHA1

                                  8e15d7c4b7812a1da6c91738c7178adf0ff3200f

                                  SHA256

                                  f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50

                                  SHA512

                                  8feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Opera_installer_240420095527801208.dll
                                  Filesize

                                  4.6MB

                                  MD5

                                  0415cb7be0361a74a039d5f31e72fa65

                                  SHA1

                                  46ae154436c8c059ee75cbc6a18ccda96bb2021d

                                  SHA256

                                  bb38a8806705980ee3e9181c099e8d5c425e6c9505a88e5af538ca6a48951798

                                  SHA512

                                  f71c2b9e1559aa4eb2d72f852ef9807c781d4a7b96b8e0c2c53b895885319146bd43aa6e4223d43159f3d40bc60704206404dc034500e47fca0a94e53b60239e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
                                  Filesize

                                  14.7MB

                                  MD5

                                  6955715b6ff15bdc153a2431cc395cca

                                  SHA1

                                  272e1eec66a1871b300484b2200b507a4abe5420

                                  SHA256

                                  a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761

                                  SHA512

                                  cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dll
                                  Filesize

                                  1.6MB

                                  MD5

                                  8f75e17a8bf3de6e22e77b5586f8a869

                                  SHA1

                                  e0bf196cfc19a8772e003b9058bdc211b419b261

                                  SHA256

                                  5f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985

                                  SHA512

                                  5a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
                                  Filesize

                                  2.4MB

                                  MD5

                                  9fb4770ced09aae3b437c1c6eb6d7334

                                  SHA1

                                  fe54b31b0db8665aa5b22bed147e8295afc88a03

                                  SHA256

                                  a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                                  SHA512

                                  140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dll
                                  Filesize

                                  1.5MB

                                  MD5

                                  7d2f87123e63950159fb2c724e55bdab

                                  SHA1

                                  360f304a6311080e1fead8591cb4659a8d135f2d

                                  SHA256

                                  b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a

                                  SHA512

                                  6cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\somebody.rtf
                                  Filesize

                                  24KB

                                  MD5

                                  ff36ebcf134c8846aea77446867e5bc6

                                  SHA1

                                  53fdf2c0bec711e377edb4f97cd147728fb568f6

                                  SHA256

                                  e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9

                                  SHA512

                                  b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\spawn.xml
                                  Filesize

                                  1.3MB

                                  MD5

                                  2d8de35aa00138b2bfc4fb0fc3d0f58b

                                  SHA1

                                  28c2d84e01815702c230da456aaa17c7d2519186

                                  SHA256

                                  19340e9202db71d8010563c8b8d325cbef5d8448a8df2ad730e74a5a46e36dac

                                  SHA512

                                  378116bc71de9f968aaef6ca27944e341a9a825a92831f5834c396160581f5e3656d3b6d1c2a304a65a74c0dd9ca0c50fb0e0016b6174d1fab68909ea1c95128

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1fhtlwat.j11.ps1
                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                  Filesize

                                  281KB

                                  MD5

                                  d98e33b66343e7c96158444127a117f6

                                  SHA1

                                  bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                  SHA256

                                  5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                  SHA512

                                  705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\uf8.0.exe
                                  Filesize

                                  353KB

                                  MD5

                                  31cb8ff276a0a394c3572a942fb623c3

                                  SHA1

                                  e64b3f111a0cd572b201ecac2b3cab849b854a06

                                  SHA256

                                  e80bfaa0b68c7040402915f2d057e7114f0a0b16ca3e36dcd937bf19341347e8

                                  SHA512

                                  cd864f77c63943836a34e6daa52c4cc65bbd6c8bf064c841598dd12f48b65a0182ce8147ebd38f5aaf25196889b1e8d23a3c73fb9d4493a95199940f9786f1be

                                  Download Submit

                                • C:\Users\Admin\Pictures\4uBfhilwjdlkKrb1TSCCuwRe.exe
                                  Filesize

                                  3.9MB

                                  MD5

                                  ffee05ea98b1d51026a44fad0841a8a9

                                  SHA1

                                  50a703329c7b9812c17a02b554cf406040079fec

                                  SHA256

                                  4cb040696b9ffb14794955b0e56eed04fde0cae3a5ee748dd513ad42c411c823

                                  SHA512

                                  626ddc18a906b74a231daa5bcc092a90708e0e3d42e4db645d59d19de7ef38a2d91a843f11dbc7873d379bfa14e87c5fc6d09a657e0b44abd24b9991cb971f86

                                  Download Submit

                                • C:\Users\Admin\Pictures\55dX5nybY74bBVYSEWX4v4JA.exe
                                  Filesize

                                  6.4MB

                                  MD5

                                  aaa56797070369ad346fbd9bb6cc5e8b

                                  SHA1

                                  a1d01943f0a354d3a000628262671254ca6a91b8

                                  SHA256

                                  9d7d08ac35f0113f7c814d257bf88b8222975aaa0a3fdeda88ac7185dbc50905

                                  SHA512

                                  e69d25a158567c6bce6e9450de17d0814b9b9c11f4bb31e5dcc3e8b4378062cc7e31da625f6ba4a2280b393034a6c832a0fc0a1e16364dc7e8c8146de245b5be

                                  Download Submit

                                • C:\Users\Admin\Pictures\7mmV2mgNZZRKBeZ3CX2aTL6F.exe
                                  Filesize

                                  5.1MB

                                  MD5

                                  4d634e5d8dfab878d40802e7639aff32

                                  SHA1

                                  225b69fc00a010ab67514c0e456231e04c39f66c

                                  SHA256

                                  1d0ca26acbe2cc2ac9a4eca37bc9f8b6220e4552067170de750e93fac7a79775

                                  SHA512

                                  d748cf06cd5af172f858811b83ad03e130b01fda254c98009433f4bb95ace9ba7b13698eab113b1ed802077249a09fbb9d507b95eaa5ad296d8bd1f851b50e94

                                  Download Submit

                                • C:\Users\Admin\Pictures\Fdme3Tu8iZv2WMfiE0EcNHfd.exe
                                  Filesize

                                  497KB

                                  MD5

                                  b9ebdc793cc3fbe86aa0a538ffc33478

                                  SHA1

                                  9375ca7ec76d457333d9d486256c38e2702d8469

                                  SHA256

                                  7753d4641934c2c05803c4d1704afa5c941d75b2d3cd67f76be27b21c66a26e9

                                  SHA512

                                  8745440e3dda6dff251fddbc19e6ae13ec757808be161551ef7ef7f26a86031191fd7327127b5120f0c1e1f8449125327c9cf3f20cc453ad92da20e36605d4f8

                                  Download Submit

                                • C:\Users\Admin\Pictures\IyV7gPo8ohrWhtnDyz03tACU.exe
                                  Filesize

                                  4.2MB

                                  MD5

                                  3b4f81a6c1cf0d18a0228d9b5797c1d1

                                  SHA1

                                  a1bbeccb2e61c5fbd1ce35898418a5f95fb1130c

                                  SHA256

                                  ef70e45cd7609f524ec2a8b4e03c846f637e6fbe04eaa46f6295609ee51f1302

                                  SHA512

                                  e7979818b4790f8089cd5c5c7d61664f08e99ea7d809e73bc31f963db2bc67fc24af486a44313b8bc878f7bb569d2b60c841e6e2548c5be98b63a11abf6c50c9

                                  Download Submit

                                • C:\Users\Admin\Pictures\jwWYQafcj1i38qa5xWnrJ8Me.exe
                                  Filesize

                                  7KB

                                  MD5

                                  5b423612b36cde7f2745455c5dd82577

                                  SHA1

                                  0187c7c80743b44e9e0c193e993294e3b969cc3d

                                  SHA256

                                  e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                  SHA512

                                  c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                  Download Submit

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                  Filesize

                                  2KB

                                  MD5

                                  968cb9309758126772781b83adb8a28f

                                  SHA1

                                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                                  SHA256

                                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                  SHA512

                                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                  Download Submit

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                  Filesize

                                  19KB

                                  MD5

                                  6e113d40c96cc7ecb7cf2895c163d489

                                  SHA1

                                  c6e33ecba70ee3ce3bf9c8dcd75e33afa067a0f6

                                  SHA256

                                  b0e48864df0efddd2417a32692e973c63c706e65894c3c7c7e57a21d7b59daf2

                                  SHA512

                                  59658604879f2c9f7d7763e5441a57eeb5eaab706aabd8cbbab89475e475a2ab325c889efa8d9896e51d3c7ec1e9082b98b6ed153bfd75d749f91dab14ce00e6

                                  Download Submit

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                  Filesize

                                  19KB

                                  MD5

                                  ce879c24aa3b4782b859b08568f7fbdf

                                  SHA1

                                  f92f9b83661bae2a21f6b2e020266d15df110922

                                  SHA256

                                  122b6d3ed38dfb27df5d1945a52c2e13930913cb50519122944075ee4171f5ee

                                  SHA512

                                  09694bea1a1a18b24c63c2ed00d13c1c4746a93ef9e14cafbda93abae732a3cce11e98e1e3b8409753e5cedfd572e336c9d0c54970db3ec0c0f4e380349ddc37

                                  Download Submit

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                  Filesize

                                  19KB

                                  MD5

                                  1c0020f110bd2fab52dfdf763a27a898

                                  SHA1

                                  46012c7b56d216261024947d4282706f7dfeb9cc

                                  SHA256

                                  06d9d4e790568d6cd719a4d13f9d8b622bb77781727417bfdb6a8a56edd4c052

                                  SHA512

                                  4f3a445e6cd9bfeb61a4c14d6b0cf287222b0b8788653569083f98541feb85932623a6f4c6d07fef120991341d3d6f2e708ed129c723665275636f817354d977

                                  Download Submit

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                  Filesize

                                  19KB

                                  MD5

                                  4d1e4391e224b60874102b6845d321d8

                                  SHA1

                                  06e49283f7962344905ab8e343c2df5031af20c8

                                  SHA256

                                  b68f32986785e90fa9f7dbac3f26a2c30b81350d56868dd653d8fbb3306d9e75

                                  SHA512

                                  41c4d71c7d95d11fc813b28be49c582de5776651cbe58aa7999d3bbdf4368d31e61afdafb20ba6a765f456fb0749141e6e661fcbc7463456d530c8b707161826

                                  Download Submit

                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                  Filesize

                                  19KB

                                  MD5

                                  75113672c1f4ef5b6740420b06722632

                                  SHA1

                                  eaa1f4634e0cb086a322ff97dfb554bb961bd4d4

                                  SHA256

                                  8fe763d4da42c1e6a57f39e75eb818bde07be027343e69e6cb351bbd3c98a7f8

                                  SHA512

                                  3b75b518887feef5327f0ae5d6bb4fcdd809af102a04cf9a99cae8ce06b73fa7d286443f9e73aec0987c1cd7e707868b1bfa72d5ac8f82b001dd9fe18410cb19

                                  Download Submit

                                • C:\Windows\System32\GroupPolicy\gpt.ini
                                  Filesize

                                  127B

                                  MD5

                                  8ef9853d1881c5fe4d681bfb31282a01

                                  SHA1

                                  a05609065520e4b4e553784c566430ad9736f19f

                                  SHA256

                                  9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                  SHA512

                                  5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                  Download Submit

                                • C:\Windows\windefender.exe
                                  Filesize

                                  2.0MB

                                  MD5

                                  8e67f58837092385dcf01e8a2b4f5783

                                  SHA1

                                  012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                  SHA256

                                  166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                  SHA512

                                  40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                  Download Submit

                                • memory/224-96-0x00000000753A0000-0x0000000075B50000-memory.dmp

                                  Filesize

                                  7.7MB

                                  Download

                                • memory/224-205-0x0000000007F80000-0x0000000007F8A000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/224-178-0x00000000082C0000-0x000000000893A000-memory.dmp

                                  Filesize

                                  6.5MB

                                  Download

                                • memory/224-179-0x0000000007C70000-0x0000000007C8A000-memory.dmp

                                  Filesize

                                  104KB

                                  Download

                                • memory/224-103-0x00000000061B0000-0x0000000006216000-memory.dmp

                                  Filesize

                                  408KB

                                  Download

                                • memory/224-102-0x00000000054A0000-0x00000000054B0000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/224-113-0x0000000006390000-0x00000000063F6000-memory.dmp

                                  Filesize

                                  408KB

                                  Download

                                • memory/224-180-0x0000000007E30000-0x0000000007E62000-memory.dmp

                                  Filesize

                                  200KB

                                  Download

                                • memory/224-194-0x0000000070050000-0x00000000703A4000-memory.dmp

                                  Filesize

                                  3.3MB

                                  Download

                                • memory/224-183-0x000000006FE90000-0x000000006FEDC000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/548-49-0x0000000001B40000-0x0000000001C40000-memory.dmp

                                  Filesize

                                  1024KB

                                  Download

                                • memory/548-147-0x00000000036B0000-0x000000000371E000-memory.dmp

                                  Filesize

                                  440KB

                                  Download

                                • memory/548-159-0x0000000000400000-0x0000000001A47000-memory.dmp

                                  Filesize

                                  22.3MB

                                  Download

                                • memory/548-51-0x0000000000400000-0x0000000001A47000-memory.dmp

                                  Filesize

                                  22.3MB

                                  Download

                                • memory/548-50-0x00000000036B0000-0x000000000371E000-memory.dmp

                                  Filesize

                                  440KB

                                  Download

                                • memory/548-155-0x0000000001B40000-0x0000000001C40000-memory.dmp

                                  Filesize

                                  1024KB

                                  Download

                                • memory/1152-129-0x0000000000400000-0x0000000001A22000-memory.dmp

                                  Filesize

                                  22.1MB

                                  Download

                                • memory/1152-130-0x0000000001C40000-0x0000000001D40000-memory.dmp

                                  Filesize

                                  1024KB

                                  Download

                                • memory/1152-128-0x0000000003640000-0x0000000003667000-memory.dmp

                                  Filesize

                                  156KB

                                  Download

                                • memory/1152-170-0x0000000000400000-0x0000000001A22000-memory.dmp

                                  Filesize

                                  22.1MB

                                  Download

                                • memory/1188-22-0x00007FFB07F10000-0x00007FFB089D1000-memory.dmp

                                  Filesize

                                  10.8MB

                                  Download

                                • memory/1188-15-0x00007FFB07F10000-0x00007FFB089D1000-memory.dmp

                                  Filesize

                                  10.8MB

                                  Download

                                • memory/1188-18-0x000001B836FA0000-0x000001B836FB0000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/1188-16-0x000001B836FA0000-0x000001B836FB0000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/1188-14-0x000001B836F50000-0x000001B836F72000-memory.dmp

                                  Filesize

                                  136KB

                                  Download

                                • memory/1436-411-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/1448-161-0x00007FFB23700000-0x00007FFB239C9000-memory.dmp

                                  Filesize

                                  2.8MB

                                  Download

                                • memory/1448-156-0x00007FF6D2950000-0x00007FF6D3459000-memory.dmp

                                  Filesize

                                  11.0MB

                                  Download

                                • memory/1448-172-0x00007FFB23700000-0x00007FFB239C9000-memory.dmp

                                  Filesize

                                  2.8MB

                                  Download

                                • memory/1448-149-0x00007FF6D2950000-0x00007FF6D3459000-memory.dmp

                                  Filesize

                                  11.0MB

                                  Download

                                • memory/1448-169-0x00007FFB23700000-0x00007FFB239C9000-memory.dmp

                                  Filesize

                                  2.8MB

                                  Download

                                • memory/1448-160-0x00007FF6D2950000-0x00007FF6D3459000-memory.dmp

                                  Filesize

                                  11.0MB

                                  Download

                                • memory/1448-173-0x00007FFB24B20000-0x00007FFB24BDE000-memory.dmp

                                  Filesize

                                  760KB

                                  Download

                                • memory/1448-174-0x00007FFB00000000-0x00007FFB00002000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/1448-175-0x00007FFB00030000-0x00007FFB00031000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/1448-176-0x00007FFB25F30000-0x00007FFB26125000-memory.dmp

                                  Filesize

                                  2.0MB

                                  Download

                                • memory/1448-150-0x00007FF6D2950000-0x00007FF6D3459000-memory.dmp

                                  Filesize

                                  11.0MB

                                  Download

                                • memory/1448-157-0x00007FF6D2950000-0x00007FF6D3459000-memory.dmp

                                  Filesize

                                  11.0MB

                                  Download

                                • memory/1448-158-0x00007FF6D2950000-0x00007FF6D3459000-memory.dmp

                                  Filesize

                                  11.0MB

                                  Download

                                • memory/1772-181-0x000000006FE90000-0x000000006FEDC000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/1772-98-0x00000000753A0000-0x0000000075B50000-memory.dmp

                                  Filesize

                                  7.7MB

                                  Download

                                • memory/1772-97-0x0000000004CC0000-0x00000000052E8000-memory.dmp

                                  Filesize

                                  6.2MB

                                  Download

                                • memory/1772-193-0x0000000007070000-0x000000000708E000-memory.dmp

                                  Filesize

                                  120KB

                                  Download

                                • memory/1772-204-0x0000000007090000-0x0000000007133000-memory.dmp

                                  Filesize

                                  652KB

                                  Download

                                • memory/1772-95-0x00000000021C0000-0x00000000021F6000-memory.dmp

                                  Filesize

                                  216KB

                                  Download

                                • memory/1772-182-0x0000000070050000-0x00000000703A4000-memory.dmp

                                  Filesize

                                  3.3MB

                                  Download

                                • memory/1772-171-0x0000000006BC0000-0x0000000006C36000-memory.dmp

                                  Filesize

                                  472KB

                                  Download

                                • memory/1772-100-0x0000000004680000-0x0000000004690000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/1772-99-0x00000000049F0000-0x0000000004A12000-memory.dmp

                                  Filesize

                                  136KB

                                  Download

                                • memory/1772-101-0x0000000004680000-0x0000000004690000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/1772-136-0x0000000006020000-0x0000000006064000-memory.dmp

                                  Filesize

                                  272KB

                                  Download

                                • memory/1772-132-0x0000000005AF0000-0x0000000005B3C000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/1772-131-0x0000000005AA0000-0x0000000005ABE000-memory.dmp

                                  Filesize

                                  120KB

                                  Download

                                • memory/1772-126-0x0000000005640000-0x0000000005994000-memory.dmp

                                  Filesize

                                  3.3MB

                                  Download

                                • memory/1888-124-0x00000000753A0000-0x0000000075B50000-memory.dmp

                                  Filesize

                                  7.7MB

                                  Download

                                • memory/1888-148-0x0000000005620000-0x0000000005630000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/1888-19-0x0000000005620000-0x0000000005630000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/1888-17-0x00000000753A0000-0x0000000075B50000-memory.dmp

                                  Filesize

                                  7.7MB

                                  Download

                                • memory/1888-4-0x0000000000400000-0x0000000000408000-memory.dmp

                                  Filesize

                                  32KB

                                  Download

                                • memory/2548-3-0x000001B20A0B0000-0x000001B20A10E000-memory.dmp

                                  Filesize

                                  376KB

                                  Download

                                • memory/2548-1-0x00007FFB07F10000-0x00007FFB089D1000-memory.dmp

                                  Filesize

                                  10.8MB

                                  Download

                                • memory/2548-0-0x000001B209CE0000-0x000001B209CEE000-memory.dmp

                                  Filesize

                                  56KB

                                  Download

                                • memory/2548-2-0x000001B224310000-0x000001B224320000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/2548-23-0x00007FFB07F10000-0x00007FFB089D1000-memory.dmp

                                  Filesize

                                  10.8MB

                                  Download

                                • memory/3056-440-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/3320-516-0x0000000000400000-0x00000000008DF000-memory.dmp

                                  Filesize

                                  4.9MB

                                  Download

                                • memory/3328-254-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/3328-206-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/3328-177-0x0000000003B20000-0x0000000003F1D000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/3328-82-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/3328-81-0x0000000003F20000-0x000000000480B000-memory.dmp

                                  Filesize

                                  8.9MB

                                  Download

                                • memory/3328-80-0x0000000003B20000-0x0000000003F1D000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/4620-545-0x0000000000400000-0x00000000008DF000-memory.dmp

                                  Filesize

                                  4.9MB

                                  Download

                                • memory/4620-524-0x0000000000400000-0x00000000008DF000-memory.dmp

                                  Filesize

                                  4.9MB

                                  Download

                                • memory/5096-265-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/5096-85-0x0000000003A20000-0x0000000003E1E000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/5096-84-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/5096-83-0x0000000003F20000-0x000000000480B000-memory.dmp

                                  Filesize

                                  8.9MB

                                  Download

                                • memory/5192-520-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/5192-553-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/5192-546-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/5192-539-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/5192-534-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/5192-527-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download

                                • memory/5192-506-0x0000000000400000-0x0000000001E06000-memory.dmp

                                  Filesize

                                  26.0MB

                                  Download