Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 03:34

General

  • Target

    e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe

  • Size

    1.8MB

  • MD5

    5535f432a7681cd4351a8e138bdbf3c4

  • SHA1

    1267f722924f247652d2a6680877c7bc05761517

  • SHA256

    e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6

  • SHA512

    c9c825dc92154072054aab7cae034fe0b39e06ca8a19269589259e0b8ab73b2cc824b554b014a3931bc141c467cb16cf8d897cf59e9b48a827a64dae9202aa5e

  • SSDEEP

    49152:Pd/xREYfjcm31fb1N74gZBxSjg0ewqaP:PfREYr33xbT74KBwAwj

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

Test1234

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://52.143.157.84

http://185.172.128.76

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

lumma

C2

https://affordcharmcropwo.shop/api

https://cleartotalfisherwo.shop/api

https://worryfillvolcawoi.shop/api

https://enthusiasimtitleow.shop/api

https://dismissalcylinderhostw.shop/api

https://diskretainvigorousiw.shop/api

https://communicationgenerwo.shop/api

https://productivelookewr.shop/api

https://pillowbrocccolipe.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 5 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 5 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies firewall policy service 2 TTPs 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Stops running service(s) 3 TTPs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 50 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 20 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 6 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 6 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe
    "C:\Users\Admin\AppData\Local\Temp\e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2548
  • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
      "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:1664
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 868
          3⤵
          • Program crash
          PID:764
      • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
        "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:932
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:884
          • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
            4⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1668
          • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4724
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
            4⤵
              PID:3192
              • C:\Windows\SysWOW64\choice.exe
                choice /C Y /N /D Y /T 3
                5⤵
                  PID:1240
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 360
              3⤵
              • Program crash
              PID:4244
          • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2448
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:4920
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 360
                3⤵
                • Program crash
                PID:3024
            • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
              "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
              2⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4980
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
                3⤵
                • Creates scheduled task(s)
                PID:3896
              • C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe
                "C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe"
                3⤵
                • UAC bypass
                • Windows security bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Suspicious use of SetThreadContext
                • System policy modification
                PID:740
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe" -Force
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5092
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1944
                  • C:\Users\Admin\Pictures\RX7D2vpx9lchoDcWXIyFxKP1.exe
                    "C:\Users\Admin\Pictures\RX7D2vpx9lchoDcWXIyFxKP1.exe"
                    5⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    PID:3096
                    • C:\Users\Admin\AppData\Local\Temp\u2e0.0.exe
                      "C:\Users\Admin\AppData\Local\Temp\u2e0.0.exe"
                      6⤵
                      • Blocklisted process makes network request
                      • Executes dropped EXE
                      PID:2656
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 1016
                        7⤵
                        • Program crash
                        PID:5772
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 1292
                        7⤵
                        • Program crash
                        PID:4136
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 1340
                        7⤵
                        • Program crash
                        PID:5868
                    • C:\Users\Admin\AppData\Local\Temp\u2e0.2\run.exe
                      "C:\Users\Admin\AppData\Local\Temp\u2e0.2\run.exe"
                      6⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetWindowsHookEx
                      PID:5548
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\SysWOW64\cmd.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        PID:5760
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          PID:4800
                    • C:\Users\Admin\AppData\Local\Temp\u2e0.3.exe
                      "C:\Users\Admin\AppData\Local\Temp\u2e0.3.exe"
                      6⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:1920
                      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                        7⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5552
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 1456
                      6⤵
                      • Program crash
                      PID:5500
                  • C:\Users\Admin\Pictures\pL6FbSzAJpQmgCw5c7FMyTCS.exe
                    "C:\Users\Admin\Pictures\pL6FbSzAJpQmgCw5c7FMyTCS.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:5092
                  • C:\Users\Admin\Pictures\RQ5GRHsZPTxkmcLykLyrD6J8.exe
                    "C:\Users\Admin\Pictures\RQ5GRHsZPTxkmcLykLyrD6J8.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:2600
                  • C:\Users\Admin\Pictures\HxwndxdTEC4tRf45pZw7hAn0.exe
                    "C:\Users\Admin\Pictures\HxwndxdTEC4tRf45pZw7hAn0.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:5752
                    • C:\Users\Admin\AppData\Local\Temp\7zS5A40.tmp\Install.exe
                      .\Install.exe /RvdidblCuX "385118" /S
                      6⤵
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:5828
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 03:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\TprteNu.exe\" em /oisite_idqJW 385118 /S" /V1 /F
                        7⤵
                        • Drops file in Windows directory
                        • Creates scheduled task(s)
                        PID:4692
                  • C:\Users\Admin\Pictures\gcdcBSqFa0nx5r4VeECLHNWm.exe
                    "C:\Users\Admin\Pictures\gcdcBSqFa0nx5r4VeECLHNWm.exe" --silent --allusers=0
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Enumerates connected drives
                    PID:6044
                    • C:\Users\Admin\Pictures\gcdcBSqFa0nx5r4VeECLHNWm.exe
                      C:\Users\Admin\Pictures\gcdcBSqFa0nx5r4VeECLHNWm.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x6ddce1d0,0x6ddce1dc,0x6ddce1e8
                      6⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:4900
                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\gcdcBSqFa0nx5r4VeECLHNWm.exe
                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\gcdcBSqFa0nx5r4VeECLHNWm.exe" --version
                      6⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:540
                  • C:\Users\Admin\Pictures\9L6c9PYhL5GMiZiXTc6jlpzN.exe
                    "C:\Users\Admin\Pictures\9L6c9PYhL5GMiZiXTc6jlpzN.exe"
                    5⤵
                    • Modifies firewall policy service
                    • Windows security bypass
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Drops file in System32 directory
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:6056
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                  4⤵
                    PID:544
              • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
                "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1316
              • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
                "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:544
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  3⤵
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4144
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                2⤵
                • Loads dropped DLL
                PID:2828
                • C:\Windows\system32\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                  3⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1372
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profiles
                    4⤵
                      PID:1044
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\556644402199_Desktop.zip' -CompressionLevel Optimal
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5036
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                  2⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  PID:1372
                • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
                  2⤵
                  • UAC bypass
                  • Windows security bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Windows security modification
                  • Checks whether UAC is enabled
                  • Suspicious use of SetThreadContext
                  • System policy modification
                  PID:4584
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1456
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                    3⤵
                    • Checks computer location settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2036
                    • C:\Users\Admin\Pictures\J0FmZbISAJIWTssvwmB5HAUF.exe
                      "C:\Users\Admin\Pictures\J0FmZbISAJIWTssvwmB5HAUF.exe"
                      4⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      PID:3192
                      • C:\Users\Admin\AppData\Local\Temp\u2go.0.exe
                        "C:\Users\Admin\AppData\Local\Temp\u2go.0.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:5348
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 1016
                          6⤵
                          • Program crash
                          PID:632
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 1300
                          6⤵
                          • Program crash
                          PID:1588
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 1328
                          6⤵
                          • Program crash
                          PID:5220
                      • C:\Users\Admin\AppData\Local\Temp\u2go.2\run.exe
                        "C:\Users\Admin\AppData\Local\Temp\u2go.2\run.exe"
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetWindowsHookEx
                        PID:5796
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\SysWOW64\cmd.exe
                          6⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          PID:2656
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            7⤵
                              PID:3260
                        • C:\Users\Admin\AppData\Local\Temp\u2go.3.exe
                          "C:\Users\Admin\AppData\Local\Temp\u2go.3.exe"
                          5⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          PID:1416
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1432
                          5⤵
                          • Program crash
                          PID:5604
                      • C:\Users\Admin\Pictures\dyqheVShAUREFxYNksrxoLdi.exe
                        "C:\Users\Admin\Pictures\dyqheVShAUREFxYNksrxoLdi.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:1952
                      • C:\Users\Admin\Pictures\EgFKOFI2GR8ebW5qlV87i4ik.exe
                        "C:\Users\Admin\Pictures\EgFKOFI2GR8ebW5qlV87i4ik.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:4920
                      • C:\Users\Admin\Pictures\Ss7FRNbPoFLjNbD205Rjt2ur.exe
                        "C:\Users\Admin\Pictures\Ss7FRNbPoFLjNbD205Rjt2ur.exe"
                        4⤵
                        • Modifies firewall policy service
                        • Windows security bypass
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Drops file in System32 directory
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:5168
                      • C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe
                        "C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe" --silent --allusers=0
                        4⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Enumerates connected drives
                        • Modifies system certificate store
                        PID:5148
                        • C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe
                          C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0xfc,0x27c,0x2a0,0xe0,0x2a4,0x6ec0e1d0,0x6ec0e1dc,0x6ec0e1e8
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:5944
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\DgfaXTld2wiWW0i5eGY8ps27.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\DgfaXTld2wiWW0i5eGY8ps27.exe" --version
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:5700
                        • C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe
                          "C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5148 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240426033542" --session-guid=c7c72f35-1dbc-4043-96c2-7ec240876b5c --server-tracking-blob="OGVkYTIzYzYyYTE4NmJhNTM3NmUxODgwMTY2ZGU3Yjc5ZTNjMzcwNDIxNDc2ZGJjZjgwM2Q2OTZlOGZjMGUzMDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MTAyNTI5Ljg1MTYiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiNjU0NDNhNDQtMjlkOS00YzRlLTlkOGItMGRiZGQ1NjdiNjVlIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6805000000000000
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates connected drives
                          PID:6048
                          • C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe
                            C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2a4,0x2a8,0x2ac,0x278,0x2b0,0x6e28e1d0,0x6e28e1dc,0x6e28e1e8
                            6⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:4720
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:5560
                        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\assistant_installer.exe
                          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\assistant_installer.exe" --version
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:4676
                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\assistant_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x6c6038,0x6c6044,0x6c6050
                            6⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:5584
                      • C:\Users\Admin\Pictures\EtUucxZCfeO1fzwNt6O7ue15.exe
                        "C:\Users\Admin\Pictures\EtUucxZCfeO1fzwNt6O7ue15.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:2360
                        • C:\Users\Admin\AppData\Local\Temp\7zSBD31.tmp\Install.exe
                          .\Install.exe /RvdidblCuX "385118" /S
                          5⤵
                          • Checks BIOS information in registry
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Enumerates system info in registry
                          PID:3604
                          • C:\Windows\SysWOW64\forfiles.exe
                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                            6⤵
                              PID:5648
                              • C:\Windows\SysWOW64\cmd.exe
                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                7⤵
                                  PID:4144
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                    8⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1980
                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                      9⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3020
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 03:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\oUuodel.exe\" em /KEsite_idlbH 385118 /S" /V1 /F
                                6⤵
                                • Drops file in Windows directory
                                • Creates scheduled task(s)
                                PID:3020
                      • C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"
                        2⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        PID:4572
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "
                          3⤵
                            PID:3604
                            • C:\Windows\SysWOW64\sc.exe
                              Sc delete GameServerClient
                              4⤵
                              • Launches sc.exe
                              PID:5468
                            • C:\Program Files (x86)\GameServerClient\GameService.exe
                              GameService remove GameServerClient confirm
                              4⤵
                              • Executes dropped EXE
                              PID:5576
                            • C:\Program Files (x86)\GameServerClient\GameService.exe
                              GameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                              4⤵
                              • Executes dropped EXE
                              PID:5800
                            • C:\Program Files (x86)\GameServerClient\GameService.exe
                              GameService start GameServerClient
                              4⤵
                              • Executes dropped EXE
                              PID:5900
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "
                            3⤵
                              PID:1416
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                              3⤵
                                PID:1404
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4144 -ip 4144
                            1⤵
                              PID:3480
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 932 -ip 932
                              1⤵
                                PID:2308
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2448 -ip 2448
                                1⤵
                                  PID:4408
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                  1⤵
                                    PID:5416
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                    1⤵
                                      PID:5424
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2656 -ip 2656
                                      1⤵
                                        PID:5752
                                      • C:\Program Files (x86)\GameServerClient\GameService.exe
                                        "C:\Program Files (x86)\GameServerClient\GameService.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:5924
                                        • C:\Program Files (x86)\GameServerClient\GameServerClient.exe
                                          "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          PID:6064
                                          • C:\Windows\Temp\785141.exe
                                            "C:\Windows\Temp\785141.exe" --list-devices
                                            3⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            PID:6104
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2656 -ip 2656
                                        1⤵
                                          PID:4020
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2656 -ip 2656
                                          1⤵
                                            PID:4140
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3096 -ip 3096
                                            1⤵
                                              PID:5344
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5348 -ip 5348
                                              1⤵
                                                PID:5968
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3192 -ip 3192
                                                1⤵
                                                  PID:2992
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5348 -ip 5348
                                                  1⤵
                                                    PID:5916
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5348 -ip 5348
                                                    1⤵
                                                      PID:6008
                                                    • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                      C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:5404
                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                      1⤵
                                                        PID:1416
                                                      • C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\oUuodel.exe
                                                        C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\oUuodel.exe em /KEsite_idlbH 385118 /S
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:3848
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:5756
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:5648
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                4⤵
                                                                  PID:2396
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:4660
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:4424
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:3688
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:5228
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:5468
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:1268
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:3684
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:1496
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:4908
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:5864
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:3552
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:2296
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:1204
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:1992
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:1332
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:1316
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:3376
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:5652
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:5448
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:5808
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:2708
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2912

                                                                                                    Network

                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • C:\Program Files (x86)\GameServerClient\GameServerClient.exe

                                                                                                            Filesize

                                                                                                            2.5MB

                                                                                                            MD5

                                                                                                            bf4360d76b38ed71a8ec2391f1985a5f

                                                                                                            SHA1

                                                                                                            57d28dc8fd4ac052d0ae32ca22143e7b57733003

                                                                                                            SHA256

                                                                                                            4ebec636d15203378e15cc11967d00cbd17e040db1fca85cf3c10bbf7451adaf

                                                                                                            SHA512

                                                                                                            7b46bc87dc384d8227adf5b538861165fa9efa18e28f2de5c1a1bb1a3a9f6bef29b449706c4d8e637ae9805bb51c8548cb761facf82d1c273d3e3699ae727acd

                                                                                                          • C:\Program Files (x86)\GameServerClient\GameService.exe

                                                                                                            Filesize

                                                                                                            288KB

                                                                                                            MD5

                                                                                                            d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                                                                                            SHA1

                                                                                                            e1908caab6f938404af85a7df0f80f877a4d9ee6

                                                                                                            SHA256

                                                                                                            472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                                                                                            SHA512

                                                                                                            1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                                                                                          • C:\Program Files (x86)\GameServerClient\installg.bat

                                                                                                            Filesize

                                                                                                            238B

                                                                                                            MD5

                                                                                                            b6b57c523f3733580d973f0f79d5c609

                                                                                                            SHA1

                                                                                                            2cc30cfd66817274c84f71d46f60d9e578b7bf95

                                                                                                            SHA256

                                                                                                            d8d718641bdf39cca1a5db7bb52d3c66d400a97bef3cafdd81cd7e711a51c570

                                                                                                            SHA512

                                                                                                            d39440163592bc3b1cb7830f236a97d5819c10775e453637d5a04a981e9a336480c6b4701afdceba0d52dfe09413b7abe2ad58ff55b5057a26229f3ccdc3a7c7

                                                                                                          • C:\ProgramData\mozglue.dll

                                                                                                            Filesize

                                                                                                            593KB

                                                                                                            MD5

                                                                                                            c8fd9be83bc728cc04beffafc2907fe9

                                                                                                            SHA1

                                                                                                            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                            SHA256

                                                                                                            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                            SHA512

                                                                                                            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                          • C:\ProgramData\nss3.dll

                                                                                                            Filesize

                                                                                                            2.0MB

                                                                                                            MD5

                                                                                                            1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                            SHA1

                                                                                                            6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                            SHA256

                                                                                                            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                            SHA512

                                                                                                            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                            Filesize

                                                                                                            3KB

                                                                                                            MD5

                                                                                                            fe3aab3ae544a134b68e881b82b70169

                                                                                                            SHA1

                                                                                                            926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

                                                                                                            SHA256

                                                                                                            bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

                                                                                                            SHA512

                                                                                                            3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            74cd4674166ac8f1bea0a81b6bb8eabc

                                                                                                            SHA1

                                                                                                            0e7e9faee65e22e86a0f47664f3489c12e710d90

                                                                                                            SHA256

                                                                                                            430d083ba64e6ecf668e892360b5a4a3423ff492e84f01f14aa69957de2e1e44

                                                                                                            SHA512

                                                                                                            ce07207402aefa1503da21c5cc29e55f777abd5a04b2b41061c6d6a37da7ec3a2df0388c7481bf0c71e4f656cb703ca19c6ecde9cbe5ae21d2948321ee7d7391

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            944B

                                                                                                            MD5

                                                                                                            6ffd055144ab0c1bb63bd1e0dfba0c45

                                                                                                            SHA1

                                                                                                            8344100b036ade6e8014c29eb2e197e4fc5f1cf5

                                                                                                            SHA256

                                                                                                            d82db5962f256b158ff42c9d8afe0f59d993f405ff67c7b061973ed29fe0a9fb

                                                                                                            SHA512

                                                                                                            ad8b328bb63cb55f471a9846f58478350d3a53f0919560e803c32040b163581f7df00d3bb264675fd2248817880007c3ef9559172e1dccecfc53edd04d6baf0e

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\additional_file0.tmp

                                                                                                            Filesize

                                                                                                            2.5MB

                                                                                                            MD5

                                                                                                            15d8c8f36cef095a67d156969ecdb896

                                                                                                            SHA1

                                                                                                            a1435deb5866cd341c09e56b65cdda33620fcc95

                                                                                                            SHA256

                                                                                                            1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8

                                                                                                            SHA512

                                                                                                            d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\opera_package

                                                                                                            Filesize

                                                                                                            103.9MB

                                                                                                            MD5

                                                                                                            b7e7c07657383452919ee39c5b975ae8

                                                                                                            SHA1

                                                                                                            2a6463ac1eb8be1825b123b12f75c86b7fff6591

                                                                                                            SHA256

                                                                                                            1d3f55e541be41e98341cb1d7b5d10487f886093370bdccdb26c70c322246bb9

                                                                                                            SHA512

                                                                                                            daeabc9a4d76e1107681e96b1371682fa6dd589001f8b03fe41165d5c32a96179daeac359f86772c9768fdbdee271c16f92ad0dbd10b2fc7cde3970f0c92aa39

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe

                                                                                                            Filesize

                                                                                                            321KB

                                                                                                            MD5

                                                                                                            1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                                                                            SHA1

                                                                                                            33aedadb5361f1646cffd68791d72ba5f1424114

                                                                                                            SHA256

                                                                                                            e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                                                                            SHA512

                                                                                                            53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe

                                                                                                            Filesize

                                                                                                            2.7MB

                                                                                                            MD5

                                                                                                            31841361be1f3dc6c2ce7756b490bf0f

                                                                                                            SHA1

                                                                                                            ff2506641a401ac999f5870769f50b7326f7e4eb

                                                                                                            SHA256

                                                                                                            222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                                                                                            SHA512

                                                                                                            53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe

                                                                                                            Filesize

                                                                                                            460KB

                                                                                                            MD5

                                                                                                            b22521fb370921bb5d69bf8deecce59e

                                                                                                            SHA1

                                                                                                            3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea

                                                                                                            SHA256

                                                                                                            b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158

                                                                                                            SHA512

                                                                                                            1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

                                                                                                            Filesize

                                                                                                            418KB

                                                                                                            MD5

                                                                                                            0099a99f5ffb3c3ae78af0084136fab3

                                                                                                            SHA1

                                                                                                            0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                            SHA256

                                                                                                            919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                            SHA512

                                                                                                            5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe

                                                                                                            Filesize

                                                                                                            304KB

                                                                                                            MD5

                                                                                                            8510bcf5bc264c70180abe78298e4d5b

                                                                                                            SHA1

                                                                                                            2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                                                                                                            SHA256

                                                                                                            096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                                                                                                            SHA512

                                                                                                            5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe

                                                                                                            Filesize

                                                                                                            158KB

                                                                                                            MD5

                                                                                                            586f7fecacd49adab650fae36e2db994

                                                                                                            SHA1

                                                                                                            35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                                                                            SHA256

                                                                                                            cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                                                                            SHA512

                                                                                                            a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe

                                                                                                            Filesize

                                                                                                            782KB

                                                                                                            MD5

                                                                                                            7fabf15848c951f6665ec449c8c77098

                                                                                                            SHA1

                                                                                                            f9ef6114a8e2d3838d0cadd4a71d6baf95e133cf

                                                                                                            SHA256

                                                                                                            a440e88b2c1d1746b82ffaadaef0571a14f3d76dbabba87b0c3de6ac5eff2f35

                                                                                                            SHA512

                                                                                                            4e8b84b13bf04befb12d2f1b2f36a1a7285be640315c1a8eb61137f77ca2202b62892d95fee02debaa75ca3b5d782a5d0a7a08a010206929187504a91e9ddb0a

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe

                                                                                                            Filesize

                                                                                                            2.4MB

                                                                                                            MD5

                                                                                                            6184676075afacb9103ae8cbf542c1ed

                                                                                                            SHA1

                                                                                                            bc757642ad2fcfd6d1da79c0754323cdc823a937

                                                                                                            SHA256

                                                                                                            a0b0b39b69005a2d39a8b8271a3518aa0a55148b794d2b4995b3c87ed183b23b

                                                                                                            SHA512

                                                                                                            861ac361b585a069f2274b577b30f2a13baf72a60acd4f22da41885aee92c3975445150822f1072590d7b574ff54eb3abde6a6c4f800988ab9ff4344884f41fa

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe

                                                                                                            Filesize

                                                                                                            789KB

                                                                                                            MD5

                                                                                                            8026082d59bac905bcc4098c69b98743

                                                                                                            SHA1

                                                                                                            5c8bffce653aa3b6c3e14d5f02927648b5ca8768

                                                                                                            SHA256

                                                                                                            f6bfa172fb2a124980f8134f6b5c765e7af52133a0c828e87d05b40a1a3f5005

                                                                                                            SHA512

                                                                                                            304339d26694f1225a23014862676f759c9332ea43ab53c9cb665346228dbed5ece4dca5e41b4d577fdf18ea70f7c61cda852e5122a7fbcf3bdfec5acc0f9f42

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

                                                                                                            Filesize

                                                                                                            1.8MB

                                                                                                            MD5

                                                                                                            5535f432a7681cd4351a8e138bdbf3c4

                                                                                                            SHA1

                                                                                                            1267f722924f247652d2a6680877c7bc05761517

                                                                                                            SHA256

                                                                                                            e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6

                                                                                                            SHA512

                                                                                                            c9c825dc92154072054aab7cae034fe0b39e06ca8a19269589259e0b8ab73b2cc824b554b014a3931bc141c467cb16cf8d897cf59e9b48a827a64dae9202aa5e

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSBD31.tmp\Install.exe

                                                                                                            Filesize

                                                                                                            6.8MB

                                                                                                            MD5

                                                                                                            e77964e011d8880eae95422769249ca4

                                                                                                            SHA1

                                                                                                            8e15d7c4b7812a1da6c91738c7178adf0ff3200f

                                                                                                            SHA256

                                                                                                            f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50

                                                                                                            SHA512

                                                                                                            8feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404260335426725700.dll

                                                                                                            Filesize

                                                                                                            4.6MB

                                                                                                            MD5

                                                                                                            45fe60d943ad11601067bc2840cc01be

                                                                                                            SHA1

                                                                                                            911d70a6aad7c10b52789c0312c5528556a2d609

                                                                                                            SHA256

                                                                                                            0715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add

                                                                                                            SHA512

                                                                                                            30c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TmpD716.tmp

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            1420d30f964eac2c85b2ccfe968eebce

                                                                                                            SHA1

                                                                                                            bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                            SHA256

                                                                                                            f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                            SHA512

                                                                                                            6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g1cupsox.g1t.ps1

                                                                                                            Filesize

                                                                                                            60B

                                                                                                            MD5

                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                            SHA1

                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                            SHA256

                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                            SHA512

                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            8cd9d82acdc4e0f7dab85e429813afdc

                                                                                                            SHA1

                                                                                                            32225fe80c793f83ed85cf5abfd1d53733e9377f

                                                                                                            SHA256

                                                                                                            e67ccd028760783174a6c7c76bea57369f903e50056a2833c0b0662222128e05

                                                                                                            SHA512

                                                                                                            40bda67bc8dfb7291eae2501e8e80b4182cb0e148e577c380be6d2d41ba65b9f407eb5c2e980b81e12b0a0e770c152f976922fcdacc471717ef4b7f8e32c402e

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

                                                                                                            Filesize

                                                                                                            3KB

                                                                                                            MD5

                                                                                                            0c93cf5968c6b2b4dcd1be339507ecd0

                                                                                                            SHA1

                                                                                                            0f123e1ccbe8be4479f538cc383467b25c370401

                                                                                                            SHA256

                                                                                                            07f11a9880898c1579611a4606a45cb6b69a17d573b6b03f00e43bdb77cd1041

                                                                                                            SHA512

                                                                                                            33e51ff7d4da87724e01a86e52730413fe2a6ea83a7a3cf242a3064080f5acfff07ba6c6c85af0f422e5ca4389009cdbce1d901775e84fb22d30f3a16e948060

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpEFCB.tmp

                                                                                                            Filesize

                                                                                                            20KB

                                                                                                            MD5

                                                                                                            42c395b8db48b6ce3d34c301d1eba9d5

                                                                                                            SHA1

                                                                                                            b7cfa3de344814bec105391663c0df4a74310996

                                                                                                            SHA256

                                                                                                            5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

                                                                                                            SHA512

                                                                                                            7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpF00C.tmp

                                                                                                            Filesize

                                                                                                            20KB

                                                                                                            MD5

                                                                                                            49693267e0adbcd119f9f5e02adf3a80

                                                                                                            SHA1

                                                                                                            3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                            SHA256

                                                                                                            d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                            SHA512

                                                                                                            b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpF520.tmp

                                                                                                            Filesize

                                                                                                            46KB

                                                                                                            MD5

                                                                                                            8f5942354d3809f865f9767eddf51314

                                                                                                            SHA1

                                                                                                            20be11c0d42fc0cef53931ea9152b55082d1a11e

                                                                                                            SHA256

                                                                                                            776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

                                                                                                            SHA512

                                                                                                            fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpF65B.tmp

                                                                                                            Filesize

                                                                                                            48KB

                                                                                                            MD5

                                                                                                            349e6eb110e34a08924d92f6b334801d

                                                                                                            SHA1

                                                                                                            bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                            SHA256

                                                                                                            c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                            SHA512

                                                                                                            2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u2e0.0.exe

                                                                                                            Filesize

                                                                                                            252KB

                                                                                                            MD5

                                                                                                            92c44b47adc5e94d871e853a990630b7

                                                                                                            SHA1

                                                                                                            5a7baf9d065fe9ee4e9e68dafb4f1836c19654ad

                                                                                                            SHA256

                                                                                                            fd496043352e900780ba0ded51df57cd7ac6507ad916ff46fe2cff52e2b8e720

                                                                                                            SHA512

                                                                                                            3d8c0a5bb8c33504c44fda7e0e9ebc784b7dd0a30761922cb1858e032dfdc2a4b0cf5cd251c7c9cbb42923b0f24b07242d3fc76501cacaa4da83201c69572e5f

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u2e0.1.zip

                                                                                                            Filesize

                                                                                                            3.7MB

                                                                                                            MD5

                                                                                                            78d3ca6355c93c72b494bb6a498bf639

                                                                                                            SHA1

                                                                                                            2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e

                                                                                                            SHA256

                                                                                                            a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001

                                                                                                            SHA512

                                                                                                            1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u2e0.2\run.exe

                                                                                                            Filesize

                                                                                                            2.4MB

                                                                                                            MD5

                                                                                                            9fb4770ced09aae3b437c1c6eb6d7334

                                                                                                            SHA1

                                                                                                            fe54b31b0db8665aa5b22bed147e8295afc88a03

                                                                                                            SHA256

                                                                                                            a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                                                                                                            SHA512

                                                                                                            140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u2e0.3.exe

                                                                                                            Filesize

                                                                                                            4.6MB

                                                                                                            MD5

                                                                                                            397926927bca55be4a77839b1c44de6e

                                                                                                            SHA1

                                                                                                            e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                            SHA256

                                                                                                            4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                            SHA512

                                                                                                            cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u2go.2\UIxMarketPlugin.dll

                                                                                                            Filesize

                                                                                                            1.6MB

                                                                                                            MD5

                                                                                                            d1ba9412e78bfc98074c5d724a1a87d6

                                                                                                            SHA1

                                                                                                            0572f98d78fb0b366b5a086c2a74cc68b771d368

                                                                                                            SHA256

                                                                                                            cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15

                                                                                                            SHA512

                                                                                                            8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u2go.2\bunch.dat

                                                                                                            Filesize

                                                                                                            1.3MB

                                                                                                            MD5

                                                                                                            1e8237d3028ab52821d69099e0954f97

                                                                                                            SHA1

                                                                                                            30a6ae353adda0c471c6ed5b7a2458b07185abf2

                                                                                                            SHA256

                                                                                                            9387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742

                                                                                                            SHA512

                                                                                                            a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u2go.2\relay.dll

                                                                                                            Filesize

                                                                                                            1.5MB

                                                                                                            MD5

                                                                                                            10d51becd0bbce0fab147ff9658c565e

                                                                                                            SHA1

                                                                                                            4689a18112ff876d3c066bc8c14a08fd6b7b7a4a

                                                                                                            SHA256

                                                                                                            7b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed

                                                                                                            SHA512

                                                                                                            29faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u2go.2\whale.dbf

                                                                                                            Filesize

                                                                                                            85KB

                                                                                                            MD5

                                                                                                            a723bf46048e0bfb15b8d77d7a648c3e

                                                                                                            SHA1

                                                                                                            8952d3c34e9341e4425571e10f22b782695bb915

                                                                                                            SHA256

                                                                                                            b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422

                                                                                                            SHA512

                                                                                                            ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273

                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-355664440-2199602304-1223909400-1000\76b53b3ec448f7ccdda2063b15d2bfc3_3c734e9a-b312-446c-8ead-b81d533e01b5

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            59720252308d45b19adaa0097eaea18a

                                                                                                            SHA1

                                                                                                            6cbb16c2e95169f0f49f46381e75dc52fcd75a69

                                                                                                            SHA256

                                                                                                            6dbb5bae2806caec37f9dd4c1c1600185a7e37a62de52545550e0a2a72dbdf44

                                                                                                            SHA512

                                                                                                            66e5ef29ed1386a4117241112dd0cf5a033da1246cf631f30841fc59cd9af94f64f668e5e567c9d2844085f85ede3b684a71d57efa8f8046f3b545ccd957e376

                                                                                                          • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                            Filesize

                                                                                                            40B

                                                                                                            MD5

                                                                                                            bbafc1f02d229b7f06375c279f2336bd

                                                                                                            SHA1

                                                                                                            da645366966e5ddee428d38b80002c404fff3d80

                                                                                                            SHA256

                                                                                                            59c0f5f31dc50edfefa2a40923033d40b666b52ef1530faf2ce89b42331b5df7

                                                                                                            SHA512

                                                                                                            7ce4a0861dc90a31ebed388e0e2b809eba34b3c34cecc88b97594280f48b8c29d26d90906818bf30c3d7145f2802266d0569c9313aafd5ba1e61bbe910dea0c1

                                                                                                          • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                                                                                                            Filesize

                                                                                                            109KB

                                                                                                            MD5

                                                                                                            154c3f1334dd435f562672f2664fea6b

                                                                                                            SHA1

                                                                                                            51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                                                                                            SHA256

                                                                                                            5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                                                                                            SHA512

                                                                                                            1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                                                                                          • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

                                                                                                            Filesize

                                                                                                            1.2MB

                                                                                                            MD5

                                                                                                            f35b671fda2603ec30ace10946f11a90

                                                                                                            SHA1

                                                                                                            059ad6b06559d4db581b1879e709f32f80850872

                                                                                                            SHA256

                                                                                                            83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                                                                                                            SHA512

                                                                                                            b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                                                                                                          • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

                                                                                                            Filesize

                                                                                                            304KB

                                                                                                            MD5

                                                                                                            0c582da789c91878ab2f1b12d7461496

                                                                                                            SHA1

                                                                                                            238bd2408f484dd13113889792d6e46d6b41c5ba

                                                                                                            SHA256

                                                                                                            a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                                                                                                            SHA512

                                                                                                            a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                                                                                                          • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

                                                                                                            Filesize

                                                                                                            750KB

                                                                                                            MD5

                                                                                                            20ae0bb07ba77cb3748aa63b6eb51afb

                                                                                                            SHA1

                                                                                                            87c468dc8f3d90a63833d36e4c900fa88d505c6d

                                                                                                            SHA256

                                                                                                            daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                                                                                                            SHA512

                                                                                                            db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                                                                                                          • C:\Users\Admin\Pictures\9L6c9PYhL5GMiZiXTc6jlpzN.exe

                                                                                                            Filesize

                                                                                                            5.7MB

                                                                                                            MD5

                                                                                                            806f295ff14699677790ca246cb69864

                                                                                                            SHA1

                                                                                                            5ff2e05176ea77a6a12ed50ac8836757dd342829

                                                                                                            SHA256

                                                                                                            8f1fb3595585747a418c6fc186c36e3c0a98d80cc81c5df56e8faeb5b2421fb6

                                                                                                            SHA512

                                                                                                            ecb12e1d799c107f39b998851938b428b1d81906615505aff3ab8426bba06d9d827e29405d8de26761341e57ef38c059d6ec68309df938326771c11dde7175a8

                                                                                                          • C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe

                                                                                                            Filesize

                                                                                                            5.1MB

                                                                                                            MD5

                                                                                                            e9f3b59f36caa5006d962df330db1b06

                                                                                                            SHA1

                                                                                                            961bfe8fd9f460145762382932283cc2f7ca8d0a

                                                                                                            SHA256

                                                                                                            98dd89965fe9fd3f82e73118bc768d4c3daf86bfd48bb97fb2c39a054e2f6db4

                                                                                                            SHA512

                                                                                                            f44152db7b69a40ae8fb49876d96c64f3f1dd6f5984c1d83922ea54c8cbb05d9af4e75a6cfec19265a82f701c0bccb80d4125c8cf718ec477bb86560d504a561

                                                                                                          • C:\Users\Admin\Pictures\HxwndxdTEC4tRf45pZw7hAn0.exe

                                                                                                            Filesize

                                                                                                            6.8MB

                                                                                                            MD5

                                                                                                            d981fb3fc1f28bea729db051c75dae08

                                                                                                            SHA1

                                                                                                            d5eea12045a6d998da1a362f70748fc09874d0b4

                                                                                                            SHA256

                                                                                                            aa5689332012817778e4ef3602e918297c567c4d573b463f86e8d98fef2eb48f

                                                                                                            SHA512

                                                                                                            a93576bc04ac5b1ba129913c3d4e5100cf7f0f8bd7a4c9a21ce3af645624890006e087eefa5d0cbd804b7b96ebc13cf32a722b8c1d66d409879f41d5bfa974cb

                                                                                                          • C:\Users\Admin\Pictures\J0FmZbISAJIWTssvwmB5HAUF.exe

                                                                                                            Filesize

                                                                                                            395KB

                                                                                                            MD5

                                                                                                            6ce1c1803dc116ca7cf5a35622180d7c

                                                                                                            SHA1

                                                                                                            2b1e323b2551ad0aa6182255d324acd327b107b2

                                                                                                            SHA256

                                                                                                            6db08506cc36a923f0fdd800047102f398db3dbabec34e31615ee09660bad167

                                                                                                            SHA512

                                                                                                            6c04e87b7e993f516de6c9752554c4e481282dbd7a99fb854a65842e17e06c636162e3e44bd2582562581f8740b5693a208aa45dd3c330aeb1e66710a59f4551

                                                                                                          • C:\Users\Admin\Pictures\K4Wuiw28G7Etz1MQFKLUQyfh.exe

                                                                                                            Filesize

                                                                                                            7KB

                                                                                                            MD5

                                                                                                            5b423612b36cde7f2745455c5dd82577

                                                                                                            SHA1

                                                                                                            0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                            SHA256

                                                                                                            e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                            SHA512

                                                                                                            c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                          • C:\Users\Admin\Pictures\RX7D2vpx9lchoDcWXIyFxKP1.exe

                                                                                                            Filesize

                                                                                                            395KB

                                                                                                            MD5

                                                                                                            89f5e843b20c7735afd6914c6aebe6ec

                                                                                                            SHA1

                                                                                                            b2449b271db033525f7716af962c6a2b2b91055d

                                                                                                            SHA256

                                                                                                            1a45382fe13dc5f3e5ae8bd66d0a95172963a4a8211cdf212e7d1db21dcbe82f

                                                                                                            SHA512

                                                                                                            4dfe8bae3d958723e45f6539c98534e5c2d6806a77308518c5cef61a5650f584473dab01fc0a9d6f3dcfd11218884afd765912022d9b9a86cacf2f589339efc0

                                                                                                          • C:\Users\Admin\Pictures\Ss7FRNbPoFLjNbD205Rjt2ur.exe

                                                                                                            Filesize

                                                                                                            5.4MB

                                                                                                            MD5

                                                                                                            69f6614893028c60394f744c7ebc1551

                                                                                                            SHA1

                                                                                                            ccd4a9f86876ddbfe2bc86a2b17a4cbc1857b1dd

                                                                                                            SHA256

                                                                                                            b96a4de2d4f97380388b6b515e8cdef28a92f358a7d487be3463828303d8661d

                                                                                                            SHA512

                                                                                                            4a40bcf25303accf93bb15e281a53ee0cda93c1f7c1ede741338b8080daa0a61c6751c5d11ed8ceeec520782913f748298b5016565a31f47c980d8e868461855

                                                                                                          • C:\Users\Admin\Pictures\gcdcBSqFa0nx5r4VeECLHNWm.exe

                                                                                                            Filesize

                                                                                                            5.1MB

                                                                                                            MD5

                                                                                                            72826b80b227a06ac2a3eb4d08357ec1

                                                                                                            SHA1

                                                                                                            3eb1dff1b53c5ab63a3d68d01fb98043c2f04901

                                                                                                            SHA256

                                                                                                            3b42181f07b4ca26e9f0e1343e5c836a9923f5b5d3a229a4ee77449a1373d613

                                                                                                            SHA512

                                                                                                            2d852e21622edad7f7d963dc45d55435b4378fca47d6da698ba76c3db4f1417367dbe33c08070dab7839346685bf79b97ba5dcd8c26b016201a3234dab928784

                                                                                                          • C:\Users\Admin\Pictures\pL6FbSzAJpQmgCw5c7FMyTCS.exe

                                                                                                            Filesize

                                                                                                            4.1MB

                                                                                                            MD5

                                                                                                            625c9d8f4ae08b1ff8a24a6deab68b71

                                                                                                            SHA1

                                                                                                            907421cb2d7dc1b975793c1f5597d6d348a93a93

                                                                                                            SHA256

                                                                                                            5d3a0e34af31fe937f3ff486ff4e185f9cbe7c6ec43cea6572b4658ae581c245

                                                                                                            SHA512

                                                                                                            60dc4f2d8dae943cb5520690832fe52eed56259461b3d357a33ca5e280a07aa18dd796862af58882d188e14ce48d944629c6aa7749bc4dae08c27de8f9ca231d

                                                                                                          • C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            b6b5cafcd706c664afdcff9675b3ef3f

                                                                                                            SHA1

                                                                                                            e7bdfb01be7edd492eafe4c868127670c0bb6d7a

                                                                                                            SHA256

                                                                                                            7088b9ec29db6f9b7b941a9a29351ab454a8bb66a2b5948c7c8a235ae055c25e

                                                                                                            SHA512

                                                                                                            0c4c5f0f988753aaef613d615d38ce64418f3f5af16d6676c90a69e3ee056a87a8ca6e740da461ec4bf13cf52727a42adc8e223ea73ef46628a629305fbffc51

                                                                                                          • C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            8c00bd73e2cfc43dde14bf5af85dad4c

                                                                                                            SHA1

                                                                                                            59bd6894922b808f441bd75bf6d5feaf7706929b

                                                                                                            SHA256

                                                                                                            ccc4c3de84afb30a8242eeaf7030896e82b2ce27c95ba8ad28bf8fe0cb69138a

                                                                                                            SHA512

                                                                                                            f2fee2046692a54b13c24da297fc576fba24e855f6d459c16d3946f2a4ca73f160ea96b48f556d044ab7341c5a9729520182c66fc437da3bea7df50103ae7a50

                                                                                                          • C:\Users\Public\Desktop\Microsoft Edge.lnk

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            ad80a4951a5d7e58d69a2894fa5c6c07

                                                                                                            SHA1

                                                                                                            b5e7923cbde7dd0db6cc59baaac0b59c57a432ba

                                                                                                            SHA256

                                                                                                            22ca32a5149308ba55bf1d441656e502c7830b40505256044e88cdb2c9721d72

                                                                                                            SHA512

                                                                                                            2226171f44ca8ddbf3ac12d1f68453092d929b2974df6003be2d8672ab8200ac41773f094495a2549f10915907417d19ae969464350ce18bf6db893d9a01d0e5

                                                                                                          • C:\Users\Public\Desktop\Microsoft Edge.lnk

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            3b781fea49705cd16c94a8b3ea2efc91

                                                                                                            SHA1

                                                                                                            2d47f66438840759e73695321dc43483ca68a778

                                                                                                            SHA256

                                                                                                            ca7d31fb77dca43bb39de896f87530287f5cab4d5dc19d10d606e5d464043575

                                                                                                            SHA512

                                                                                                            2a6bfcac2a5ccdc26343f4925a2e13f14d09317dba8dcebd464e50019da73d31cf085cfea03b91541d7de7d27eef19587d54da7df1991b0383e99dee0559bcf2

                                                                                                          • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                            Filesize

                                                                                                            127B

                                                                                                            MD5

                                                                                                            7cc972a3480ca0a4792dc3379a763572

                                                                                                            SHA1

                                                                                                            f72eb4124d24f06678052706c542340422307317

                                                                                                            SHA256

                                                                                                            02ad5d151250848f2cc4b650a351505aa58ac13c50da207cc06295c123ddf5e5

                                                                                                            SHA512

                                                                                                            ff5f320356e59eaf8f2b7c5a2668541252221be2d9701006fcc64ce802e66eeaf6ecf316d925258eb12ee5b8b7df4f8da075e9524badc0024b55fae639d075b7

                                                                                                          • C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                            Filesize

                                                                                                            127B

                                                                                                            MD5

                                                                                                            8ef9853d1881c5fe4d681bfb31282a01

                                                                                                            SHA1

                                                                                                            a05609065520e4b4e553784c566430ad9736f19f

                                                                                                            SHA256

                                                                                                            9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                                                                                            SHA512

                                                                                                            5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                                                                                          • memory/544-238-0x0000000000040000-0x000000000006E000-memory.dmp

                                                                                                            Filesize

                                                                                                            184KB

                                                                                                          • memory/544-250-0x00000000021F0000-0x00000000041F0000-memory.dmp

                                                                                                            Filesize

                                                                                                            32.0MB

                                                                                                          • memory/544-249-0x0000000072DC0000-0x0000000073570000-memory.dmp

                                                                                                            Filesize

                                                                                                            7.7MB

                                                                                                          • memory/544-240-0x0000000072DC0000-0x0000000073570000-memory.dmp

                                                                                                            Filesize

                                                                                                            7.7MB

                                                                                                          • memory/884-82-0x0000000004F50000-0x0000000004F60000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/884-78-0x0000000000400000-0x0000000000592000-memory.dmp

                                                                                                            Filesize

                                                                                                            1.6MB

                                                                                                          • memory/884-251-0x0000000004F50000-0x0000000004F60000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/884-246-0x0000000072DC0000-0x0000000073570000-memory.dmp

                                                                                                            Filesize

                                                                                                            7.7MB

                                                                                                          • memory/884-79-0x0000000072DC0000-0x0000000073570000-memory.dmp

                                                                                                            Filesize

                                                                                                            7.7MB

                                                                                                          • memory/932-77-0x0000000000770000-0x0000000000A28000-memory.dmp

                                                                                                            Filesize

                                                                                                            2.7MB

                                                                                                          • memory/932-83-0x0000000000770000-0x0000000000A28000-memory.dmp

                                                                                                            Filesize

                                                                                                            2.7MB

                                                                                                          • memory/1316-197-0x00000000052B0000-0x00000000052C0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1316-196-0x0000000000B20000-0x0000000000B72000-memory.dmp

                                                                                                            Filesize

                                                                                                            328KB

                                                                                                          • memory/1316-195-0x0000000072DC0000-0x0000000073570000-memory.dmp

                                                                                                            Filesize

                                                                                                            7.7MB

                                                                                                          • memory/1416-1062-0x0000000000400000-0x00000000008AD000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/1664-59-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                            Filesize

                                                                                                            304KB

                                                                                                          • memory/1664-55-0x0000000000B20000-0x0000000000B52000-memory.dmp

                                                                                                            Filesize

                                                                                                            200KB

                                                                                                          • memory/1664-56-0x0000000000B20000-0x0000000000B52000-memory.dmp

                                                                                                            Filesize

                                                                                                            200KB

                                                                                                          • memory/1664-53-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                            Filesize

                                                                                                            304KB

                                                                                                          • memory/1664-57-0x0000000000B20000-0x0000000000B52000-memory.dmp

                                                                                                            Filesize

                                                                                                            200KB

                                                                                                          • memory/1664-58-0x0000000000B20000-0x0000000000B52000-memory.dmp

                                                                                                            Filesize

                                                                                                            200KB

                                                                                                          • memory/1664-50-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                            Filesize

                                                                                                            304KB

                                                                                                          • memory/1668-103-0x0000000000430000-0x0000000000482000-memory.dmp

                                                                                                            Filesize

                                                                                                            328KB

                                                                                                          • memory/1668-159-0x0000000006670000-0x00000000066BC000-memory.dmp

                                                                                                            Filesize

                                                                                                            304KB

                                                                                                          • memory/1668-106-0x0000000072DC0000-0x0000000073570000-memory.dmp

                                                                                                            Filesize

                                                                                                            7.7MB

                                                                                                          • memory/1668-142-0x00000000059A0000-0x0000000005A16000-memory.dmp

                                                                                                            Filesize

                                                                                                            472KB

                                                                                                          • memory/1668-254-0x0000000072DC0000-0x0000000073570000-memory.dmp

                                                                                                            Filesize

                                                                                                            7.7MB

                                                                                                          • memory/1668-157-0x00000000064A0000-0x00000000064B2000-memory.dmp

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                          • memory/1668-107-0x0000000004D40000-0x0000000004DD2000-memory.dmp

                                                                                                            Filesize

                                                                                                            584KB

                                                                                                          • memory/1668-156-0x0000000006560000-0x000000000666A000-memory.dmp

                                                                                                            Filesize

                                                                                                            1.0MB

                                                                                                          • memory/1668-105-0x00000000051F0000-0x0000000005794000-memory.dmp

                                                                                                            Filesize

                                                                                                            5.6MB

                                                                                                          • memory/1668-158-0x0000000006500000-0x000000000653C000-memory.dmp

                                                                                                            Filesize

                                                                                                            240KB

                                                                                                          • memory/1668-151-0x0000000006190000-0x00000000061AE000-memory.dmp

                                                                                                            Filesize

                                                                                                            120KB

                                                                                                          • memory/1668-108-0x0000000004EF0000-0x0000000004EFA000-memory.dmp

                                                                                                            Filesize

                                                                                                            40KB

                                                                                                          • memory/1668-155-0x0000000006A10000-0x0000000007028000-memory.dmp

                                                                                                            Filesize

                                                                                                            6.1MB

                                                                                                          • memory/1944-456-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                            Filesize

                                                                                                            32KB

                                                                                                          • memory/1952-819-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                            Filesize

                                                                                                            44.0MB

                                                                                                          • memory/2036-521-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                            Filesize

                                                                                                            32KB

                                                                                                          • memory/2448-147-0x0000000000840000-0x00000000008B4000-memory.dmp

                                                                                                            Filesize

                                                                                                            464KB

                                                                                                          • memory/2548-15-0x0000000000EE0000-0x0000000001394000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/2548-9-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2548-1-0x0000000077864000-0x0000000077866000-memory.dmp

                                                                                                            Filesize

                                                                                                            8KB

                                                                                                          • memory/2548-2-0x0000000000EE0000-0x0000000001394000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/2548-0-0x0000000000EE0000-0x0000000001394000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/2548-3-0x0000000004D70000-0x0000000004D71000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2548-10-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2548-4-0x0000000004D80000-0x0000000004D81000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2548-5-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2548-7-0x0000000004D40000-0x0000000004D41000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2548-6-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2548-8-0x0000000004D50000-0x0000000004D51000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2600-731-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                            Filesize

                                                                                                            44.0MB

                                                                                                          • memory/2656-889-0x0000000000400000-0x0000000002AFD000-memory.dmp

                                                                                                            Filesize

                                                                                                            39.0MB

                                                                                                          • memory/2656-1105-0x00007FF8D0A50000-0x00007FF8D0C45000-memory.dmp

                                                                                                            Filesize

                                                                                                            2.0MB

                                                                                                          • memory/3096-995-0x0000000000400000-0x0000000002C46000-memory.dmp

                                                                                                            Filesize

                                                                                                            40.3MB

                                                                                                          • memory/3096-706-0x0000000000400000-0x0000000002C46000-memory.dmp

                                                                                                            Filesize

                                                                                                            40.3MB

                                                                                                          • memory/3192-1072-0x0000000000400000-0x0000000002C46000-memory.dmp

                                                                                                            Filesize

                                                                                                            40.3MB

                                                                                                          • memory/3192-817-0x0000000000400000-0x0000000002C46000-memory.dmp

                                                                                                            Filesize

                                                                                                            40.3MB

                                                                                                          • memory/4144-252-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                            Filesize

                                                                                                            2.2MB

                                                                                                          • memory/4144-247-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                            Filesize

                                                                                                            2.2MB

                                                                                                          • memory/4144-46-0x0000000000BC0000-0x0000000000C12000-memory.dmp

                                                                                                            Filesize

                                                                                                            328KB

                                                                                                          • memory/4144-47-0x0000000073470000-0x0000000073C20000-memory.dmp

                                                                                                            Filesize

                                                                                                            7.7MB

                                                                                                          • memory/4144-274-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                            Filesize

                                                                                                            972KB

                                                                                                          • memory/4144-243-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                            Filesize

                                                                                                            2.2MB

                                                                                                          • memory/4144-60-0x0000000073470000-0x0000000073C20000-memory.dmp

                                                                                                            Filesize

                                                                                                            7.7MB

                                                                                                          • memory/4144-54-0x0000000003080000-0x0000000005080000-memory.dmp

                                                                                                            Filesize

                                                                                                            32.0MB

                                                                                                          • memory/4568-21-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/4568-23-0x0000000004B20000-0x0000000004B21000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/4568-836-0x0000000000FD0000-0x0000000001484000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/4568-417-0x0000000000FD0000-0x0000000001484000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/4568-104-0x0000000000FD0000-0x0000000001484000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/4568-123-0x0000000000FD0000-0x0000000001484000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/4568-20-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/4568-19-0x0000000000FD0000-0x0000000001484000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/4568-18-0x0000000000FD0000-0x0000000001484000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/4568-22-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/4568-25-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/4568-239-0x0000000000FD0000-0x0000000001484000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/4568-24-0x0000000004B40000-0x0000000004B41000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/4568-1085-0x0000000000FD0000-0x0000000001484000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/4568-26-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/4568-602-0x0000000000FD0000-0x0000000001484000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                          • memory/4724-253-0x000000001DE00000-0x000000001DF0A000-memory.dmp

                                                                                                            Filesize

                                                                                                            1.0MB

                                                                                                          • memory/4724-145-0x00007FF8B0E30000-0x00007FF8B18F1000-memory.dmp

                                                                                                            Filesize

                                                                                                            10.8MB

                                                                                                          • memory/4724-149-0x000000001B8A0000-0x000000001B8B0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/4724-134-0x0000000000A20000-0x0000000000AE0000-memory.dmp

                                                                                                            Filesize

                                                                                                            768KB

                                                                                                          • memory/4920-820-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                            Filesize

                                                                                                            44.0MB

                                                                                                          • memory/4920-150-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                            Filesize

                                                                                                            312KB

                                                                                                          • memory/4920-152-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                            Filesize

                                                                                                            312KB

                                                                                                          • memory/4920-146-0x0000000000400000-0x000000000044E000-memory.dmp

                                                                                                            Filesize

                                                                                                            312KB

                                                                                                          • memory/5092-710-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                            Filesize

                                                                                                            44.0MB

                                                                                                          • memory/5092-1080-0x0000000000400000-0x0000000003005000-memory.dmp

                                                                                                            Filesize

                                                                                                            44.0MB

                                                                                                          • memory/5168-1022-0x0000000140000000-0x0000000140712000-memory.dmp

                                                                                                            Filesize

                                                                                                            7.1MB

                                                                                                          • memory/5348-1049-0x0000000000400000-0x0000000002AFD000-memory.dmp

                                                                                                            Filesize

                                                                                                            39.0MB

                                                                                                          • memory/5548-1032-0x000000006B880000-0x000000006B9FB000-memory.dmp

                                                                                                            Filesize

                                                                                                            1.5MB

                                                                                                          • memory/5548-801-0x000000006B880000-0x000000006B9FB000-memory.dmp

                                                                                                            Filesize

                                                                                                            1.5MB

                                                                                                          • memory/5548-805-0x00007FF8D0A50000-0x00007FF8D0C45000-memory.dmp

                                                                                                            Filesize

                                                                                                            2.0MB

                                                                                                          • memory/5760-1078-0x00007FF8D0A50000-0x00007FF8D0C45000-memory.dmp

                                                                                                            Filesize

                                                                                                            2.0MB

                                                                                                          • memory/5796-1077-0x000000006B880000-0x000000006B9FB000-memory.dmp

                                                                                                            Filesize

                                                                                                            1.5MB

                                                                                                          • memory/5796-1002-0x000000006B880000-0x000000006B9FB000-memory.dmp

                                                                                                            Filesize

                                                                                                            1.5MB

                                                                                                          • memory/5796-1017-0x00007FF8D0A50000-0x00007FF8D0C45000-memory.dmp

                                                                                                            Filesize

                                                                                                            2.0MB

                                                                                                          • memory/5828-837-0x0000000010000000-0x0000000013BC3000-memory.dmp

                                                                                                            Filesize

                                                                                                            59.8MB