Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
23/04/2024, 19:33
General
- Target file.exe
- Size 3.3MB
- Sample240423-x9hr2abc27
- SHA256 b79b3ab665881eadd15b67b9b105db7d99eb091905350a53c6bbc7b91a42cd48
Malware Config
Signatures
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 14 IoCs
- Modifies firewall policy service 2 TTPs 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 7 IoCs
- Executes dropped EXE 21 IoCs
- Loads dropped DLL 9 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Drops file in System32 directory 14 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 7 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 62 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\ONVoACxcRwlzFtIIO0GisxRA.exe"C:\Users\Admin\Pictures\ONVoACxcRwlzFtIIO0GisxRA.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\ONVoACxcRwlzFtIIO0GisxRA.exe"C:\Users\Admin\Pictures\ONVoACxcRwlzFtIIO0GisxRA.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Pictures\E91kHHonQTye2ZsTw3IKFqPI.exe"C:\Users\Admin\Pictures\E91kHHonQTye2ZsTw3IKFqPI.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\E91kHHonQTye2ZsTw3IKFqPI.exe"C:\Users\Admin\Pictures\E91kHHonQTye2ZsTw3IKFqPI.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\kTev2sZJ9fmg56dJy26BPkzK.exe"C:\Users\Admin\Pictures\kTev2sZJ9fmg56dJy26BPkzK.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uko.0.exe"C:\Users\Admin\AppData\Local\Temp\uko.0.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 13005⤵
- Program crash
-
-
-
-
C:\Users\Admin\Pictures\X4rN0WQ1CvVmRKXeE5IoYk8M.exe"C:\Users\Admin\Pictures\X4rN0WQ1CvVmRKXeE5IoYk8M.exe" --silent --allusers=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
-
C:\Users\Admin\Pictures\X4rN0WQ1CvVmRKXeE5IoYk8M.exeC:\Users\Admin\Pictures\X4rN0WQ1CvVmRKXeE5IoYk8M.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.59 --initial-client-data=0x2a8,0x2ac,0x2b0,0x264,0x2b4,0x6fcbe1d0,0x6fcbe1dc,0x6fcbe1e84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\X4rN0WQ1CvVmRKXeE5IoYk8M.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\X4rN0WQ1CvVmRKXeE5IoYk8M.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Pictures\X4rN0WQ1CvVmRKXeE5IoYk8M.exe"C:\Users\Admin\Pictures\X4rN0WQ1CvVmRKXeE5IoYk8M.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3204 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240423193426" --session-guid=8e2f928c-7cef-43c7-b66f-02c8813ef062 --server-tracking-blob="YzQ1ZmM2YTRjZmQxYmFlMzA2NmU1MzBiZTM5N2M1ZTllNjJlZGE3N2UxN2FmMGM2YmJkNDNlZTZhMjJmOTExZTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fMTIzIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzOTAwNzk1LjA5NjQiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzEyMyIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMmY2ZjQ1M2UtNmZhZC00YzRmLWI1MjQtOGYyNDBjZmI0OTU1In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=60040000000000004⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
-
C:\Users\Admin\Pictures\X4rN0WQ1CvVmRKXeE5IoYk8M.exeC:\Users\Admin\Pictures\X4rN0WQ1CvVmRKXeE5IoYk8M.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.59 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6eb0e1d0,0x6eb0e1dc,0x6eb0e1e85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231934261\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231934261\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231934261\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231934261\assistant\assistant_installer.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231934261\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404231934261\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x286038,0x286044,0x2860505⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\Pictures\xBlUsrbC5hAebxXClHPV2dLh.exe"C:\Users\Admin\Pictures\xBlUsrbC5hAebxXClHPV2dLh.exe"3⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Pictures\CBS5txCyfToHqdlCJ800IU4I.exe"C:\Users\Admin\Pictures\CBS5txCyfToHqdlCJ800IU4I.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS1052.tmp\Install.exe.\Install.exe /nxdidQZJ "385118" /S4⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"5⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 19:36:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\QOIbGaU.exe\" em /yGsite_idrpg 385118 /S" /V1 /F5⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4460 -ip 44601⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-Interactive
Assistant_109.0.5097.45_Setup.exe_sfx.exe
assistant_installer.exe
dbgcore.dll
dbghelp.dll
opera_package
Install.exe
Opera_installer_2404231934255843204.dll
__PSScriptPolicyTest_jd5okdg0.ysc.ps1
injector.exe
uko.0.exe
settings.dat
CBS5txCyfToHqdlCJ800IU4I.exe
ONVoACxcRwlzFtIIO0GisxRA.exe
X4rN0WQ1CvVmRKXeE5IoYk8M.exe
f8EIinrwb49WQxBLDAbUOszl.exe
kTev2sZJ9fmg56dJy26BPkzK.exe
xBlUsrbC5hAebxXClHPV2dLh.exe
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
windefender.exe
memory/744-394-0x0000000000400000-0x0000000004067000-memory.dmp
memory/756-528-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/756-462-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/1200-177-0x0000000002E80000-0x0000000002E90000-memory.dmp
memory/1200-167-0x0000000002E80000-0x0000000002E90000-memory.dmp
memory/1200-152-0x000000006FC60000-0x000000006FFB4000-memory.dmp
memory/1200-163-0x0000000007720000-0x00000000077C3000-memory.dmp
memory/1200-153-0x000000007FD70000-0x000000007FD80000-memory.dmp
memory/1200-151-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/1200-131-0x0000000002E80000-0x0000000002E90000-memory.dmp
memory/1200-129-0x0000000002E80000-0x0000000002E90000-memory.dmp
memory/1200-128-0x0000000074CE0000-0x0000000075490000-memory.dmp
memory/1780-75-0x00000000071D0000-0x0000000007202000-memory.dmp
memory/1780-76-0x000000007F490000-0x000000007F4A0000-memory.dmp
memory/1780-34-0x0000000002680000-0x00000000026B6000-memory.dmp
memory/1780-107-0x0000000007AF0000-0x0000000007B86000-memory.dmp
memory/1780-108-0x0000000007330000-0x0000000007341000-memory.dmp
memory/1780-109-0x0000000007370000-0x000000000737E000-memory.dmp
memory/1780-110-0x0000000007390000-0x00000000073A4000-memory.dmp
memory/1780-111-0x00000000073D0000-0x00000000073EA000-memory.dmp
memory/1780-40-0x0000000074CE0000-0x0000000075490000-memory.dmp
memory/1780-105-0x0000000007320000-0x000000000732A000-memory.dmp
memory/1780-39-0x0000000004DB0000-0x00000000053D8000-memory.dmp
memory/1780-118-0x0000000074CE0000-0x0000000075490000-memory.dmp
memory/1780-41-0x0000000002710000-0x0000000002720000-memory.dmp
memory/1780-42-0x0000000002710000-0x0000000002720000-memory.dmp
memory/1780-43-0x0000000004CA0000-0x0000000004CC2000-memory.dmp
memory/1780-46-0x0000000005600000-0x0000000005666000-memory.dmp
memory/1780-44-0x0000000005490000-0x00000000054F6000-memory.dmp
memory/1780-103-0x0000000002710000-0x0000000002720000-memory.dmp
memory/1780-56-0x0000000005670000-0x00000000059C4000-memory.dmp
memory/1780-57-0x0000000005C40000-0x0000000005C5E000-memory.dmp
memory/1780-101-0x0000000007230000-0x00000000072D3000-memory.dmp
memory/1780-58-0x0000000006210000-0x000000000625C000-memory.dmp
memory/1780-71-0x0000000006160000-0x00000000061A4000-memory.dmp
memory/1780-72-0x0000000006D70000-0x0000000006DE6000-memory.dmp
memory/1780-73-0x0000000007470000-0x0000000007AEA000-memory.dmp
memory/1780-88-0x0000000007210000-0x000000000722E000-memory.dmp
memory/1780-74-0x0000000006E10000-0x0000000006E2A000-memory.dmp
memory/1780-78-0x000000006FC60000-0x000000006FFB4000-memory.dmp
memory/1780-77-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/1784-130-0x0000000002CC0000-0x0000000002CD0000-memory.dmp
memory/1784-166-0x000000006FC60000-0x000000006FFB4000-memory.dmp
memory/1784-178-0x0000000002CC0000-0x0000000002CD0000-memory.dmp
memory/1784-127-0x0000000074CE0000-0x0000000075490000-memory.dmp
memory/1784-165-0x000000007F620000-0x000000007F630000-memory.dmp
memory/1784-164-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/1808-455-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/1924-124-0x00000000049A0000-0x0000000004D9E000-memory.dmp
memory/1924-337-0x0000000000400000-0x0000000004426000-memory.dmp
memory/2632-249-0x0000000000400000-0x0000000004426000-memory.dmp
memory/2632-45-0x0000000004840000-0x0000000004C3E000-memory.dmp
memory/2632-150-0x0000000004840000-0x0000000004C3E000-memory.dmp
memory/3156-560-0x00007FF6F44B0000-0x00007FF6F4BF5000-memory.dmp
memory/3156-564-0x00007FF6F44B0000-0x00007FF6F4BF5000-memory.dmp
memory/3156-558-0x00007FF6F44B0000-0x00007FF6F4BF5000-memory.dmp
memory/3156-553-0x00007FF6F44B0000-0x00007FF6F4BF5000-memory.dmp
memory/3156-554-0x00007FF6F44B0000-0x00007FF6F4BF5000-memory.dmp
memory/3156-563-0x00007FF6F44B0000-0x00007FF6F4BF5000-memory.dmp
memory/3156-565-0x00007FF6F44B0000-0x00007FF6F4BF5000-memory.dmp
memory/3156-638-0x00007FF6F44B0000-0x00007FF6F4BF5000-memory.dmp
memory/3372-60-0x00000000048C0000-0x00000000048D0000-memory.dmp
memory/3372-90-0x000000006FC60000-0x000000006FFB4000-memory.dmp
memory/3372-112-0x00000000074C0000-0x00000000074C8000-memory.dmp
memory/3372-104-0x00000000048C0000-0x00000000048D0000-memory.dmp
memory/3372-89-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/3372-61-0x00000000048C0000-0x00000000048D0000-memory.dmp
memory/3372-102-0x000000007EF60000-0x000000007EF70000-memory.dmp
memory/3372-59-0x0000000074CE0000-0x0000000075490000-memory.dmp
memory/3372-119-0x0000000074CE0000-0x0000000075490000-memory.dmp
memory/3640-1-0x0000000074CE0000-0x0000000075490000-memory.dmp
memory/3640-2-0x0000000005680000-0x0000000005690000-memory.dmp
memory/3640-0-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3640-91-0x0000000074CE0000-0x0000000075490000-memory.dmp
memory/3920-106-0x0000000004A80000-0x0000000004E81000-memory.dmp
memory/3920-225-0x0000000000400000-0x0000000004426000-memory.dmp
memory/3920-25-0x0000000004A80000-0x0000000004E81000-memory.dmp
memory/3920-26-0x0000000006630000-0x0000000006F1B000-memory.dmp
memory/4196-322-0x0000000000400000-0x0000000004426000-memory.dmp
memory/4196-125-0x00000000047E0000-0x0000000004BDF000-memory.dmp
memory/4196-126-0x0000000006480000-0x0000000006D6B000-memory.dmp
memory/4460-399-0x0000000000400000-0x0000000004043000-memory.dmp
memory/4676-437-0x0000000000400000-0x0000000004426000-memory.dmp
memory/4676-466-0x0000000000400000-0x0000000004426000-memory.dmp
memory/4676-526-0x0000000000400000-0x0000000004426000-memory.dmp
memory/4676-532-0x0000000000400000-0x0000000004426000-memory.dmp
memory/4676-633-0x0000000000400000-0x0000000004426000-memory.dmp
memory/4676-441-0x0000000000400000-0x0000000004426000-memory.dmp
memory/4676-460-0x0000000000400000-0x0000000004426000-memory.dmp
memory/4676-447-0x0000000000400000-0x0000000004426000-memory.dmp