cobaltstrike | 3245088846756009e9827fcda64556aca75b64d8b05fd63241f4ea6b7f20f540

Analysis

max time kernel
376s
max time network
378s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

P0lko.exe
Size

54.8MB
MD5

8799c59f0eb8cbb37c386c0d5a39d520
SHA1

b5b40996731bf002a1434d1b59cb02961db3ea1a
SHA256

3245088846756009e9827fcda64556aca75b64d8b05fd63241f4ea6b7f20f540
SHA512

16ce94cdb2482a49513ce92b81f120ba256fced7ff0d097656900305a3af0161d687d77397f0d2364c87fbb287caa9607a3c3334fca50711909d09411dd24f3f
SSDEEP

786432:ALOrbJjdcRWz/9kl3uu2F0tA+6liWmP3YhMfuwSk+D3wBCQXrzu2Y:ALOrJpzVA3uu2etPQiWmoh8r+78CQG2Y

Score

10^/10

cobaltstrike modiloader xmrig backdoor bootkit discovery evasion miner persistence spyware stealer trojan upx

Malware Config

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0008000000023509-2099.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/6392-2085-0x0000000000400000-0x0000000000451000-memory.dmp	modiloader_stage2
behavioral1/memory/6392-2206-0x0000000000400000-0x0000000000451000-memory.dmp	modiloader_stage2

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral1/memory/6296-2173-0x00007FF60B5A0000-0x00007FF60B8F1000-memory.dmp	xmrig
behavioral1/memory/6372-2181-0x00007FF7A9600000-0x00007FF7A9951000-memory.dmp	xmrig
behavioral1/memory/7144-2180-0x00007FF66F5D0000-0x00007FF66F921000-memory.dmp	xmrig
behavioral1/memory/7120-2182-0x00007FF7ED7B0000-0x00007FF7EDB01000-memory.dmp	xmrig
behavioral1/memory/5688-2183-0x00007FF77B9C0000-0x00007FF77BD11000-memory.dmp	xmrig
behavioral1/memory/7072-2184-0x00007FF62D280000-0x00007FF62D5D1000-memory.dmp	xmrig
behavioral1/memory/6388-2185-0x00007FF7825E0000-0x00007FF782931000-memory.dmp	xmrig
behavioral1/memory/6800-2199-0x00007FF68A000000-0x00007FF68A351000-memory.dmp	xmrig
behavioral1/memory/6892-2205-0x00007FF71C900000-0x00007FF71CC51000-memory.dmp	xmrig
behavioral1/memory/2428-2207-0x00007FF67A0B0000-0x00007FF67A401000-memory.dmp	xmrig
behavioral1/memory/6940-2208-0x00007FF647CF0000-0x00007FF648041000-memory.dmp	xmrig
behavioral1/memory/6196-2209-0x00007FF707CE0000-0x00007FF708031000-memory.dmp	xmrig
behavioral1/memory/6696-2214-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp	xmrig
behavioral1/memory/6644-2215-0x00007FF616630000-0x00007FF616981000-memory.dmp	xmrig
behavioral1/memory/5952-2216-0x00007FF7A76D0000-0x00007FF7A7A21000-memory.dmp	xmrig
behavioral1/memory/4412-2217-0x00007FF644640000-0x00007FF644991000-memory.dmp	xmrig
behavioral1/memory/4264-2218-0x00007FF749BC0000-0x00007FF749F11000-memory.dmp	xmrig
behavioral1/memory/2608-2219-0x00007FF62DBA0000-0x00007FF62DEF1000-memory.dmp	xmrig
behavioral1/memory/6464-2220-0x00007FF6BA520000-0x00007FF6BA871000-memory.dmp	xmrig
behavioral1/memory/6044-2221-0x00007FF719640000-0x00007FF719991000-memory.dmp	xmrig
behavioral1/memory/6360-2222-0x00007FF6E74D0000-0x00007FF6E7821000-memory.dmp	xmrig
behavioral1/memory/6412-2223-0x00007FF6A5530000-0x00007FF6A5881000-memory.dmp	xmrig
behavioral1/memory/6892-2288-0x00007FF71C900000-0x00007FF71CC51000-memory.dmp	xmrig
behavioral1/memory/6644-2298-0x00007FF616630000-0x00007FF616981000-memory.dmp	xmrig
behavioral1/memory/6388-2291-0x00007FF7825E0000-0x00007FF782931000-memory.dmp	xmrig
behavioral1/memory/6696-2300-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp	xmrig
behavioral1/memory/4264-2319-0x00007FF749BC0000-0x00007FF749F11000-memory.dmp	xmrig
behavioral1/memory/6464-2320-0x00007FF6BA520000-0x00007FF6BA871000-memory.dmp	xmrig
behavioral1/memory/6412-2324-0x00007FF6A5530000-0x00007FF6A5881000-memory.dmp	xmrig
behavioral1/memory/6372-2326-0x00007FF7A9600000-0x00007FF7A9951000-memory.dmp	xmrig
behavioral1/memory/7120-2322-0x00007FF7ED7B0000-0x00007FF7EDB01000-memory.dmp	xmrig
behavioral1/memory/6296-2316-0x00007FF60B5A0000-0x00007FF60B8F1000-memory.dmp	xmrig
behavioral1/memory/5952-2315-0x00007FF7A76D0000-0x00007FF7A7A21000-memory.dmp	xmrig
behavioral1/memory/6044-2314-0x00007FF719640000-0x00007FF719991000-memory.dmp	xmrig
behavioral1/memory/2608-2312-0x00007FF62DBA0000-0x00007FF62DEF1000-memory.dmp	xmrig
behavioral1/memory/6196-2311-0x00007FF707CE0000-0x00007FF708031000-memory.dmp	xmrig
behavioral1/memory/6360-2306-0x00007FF6E74D0000-0x00007FF6E7821000-memory.dmp	xmrig
behavioral1/memory/7072-2304-0x00007FF62D280000-0x00007FF62D5D1000-memory.dmp	xmrig
behavioral1/memory/6940-2302-0x00007FF647CF0000-0x00007FF648041000-memory.dmp	xmrig
behavioral1/memory/4412-2301-0x00007FF644640000-0x00007FF644991000-memory.dmp	xmrig
behavioral1/memory/5688-2297-0x00007FF77B9C0000-0x00007FF77BD11000-memory.dmp	xmrig
behavioral1/memory/2428-2293-0x00007FF67A0B0000-0x00007FF67A401000-memory.dmp	xmrig
behavioral1/memory/7144-2329-0x00007FF66F5D0000-0x00007FF66F921000-memory.dmp	xmrig

Downloads MZ/PE file

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
6132	attrib.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	avg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	aj10C7.exe

Executes dropped EXE 50 IoCs

pid	Process
3692	anti.exe
3240	butdes.exe
4368	flydes.exe
408	butdes.tmp
2960	i.exe
556	flydes.tmp
5604	gx.exe
5620	bundle.exe
5668	rckdck.exe
5728	is-QI1N3.tmp
5720	avg.exe
5788	telamon.exe
5844	setup.exe
5872	telamon.tmp
5928	stopwatch.exe
6016	setup.exe
1192	setup.exe
5560	tt-installer-helper.exe
5572	tt-installer-helper.exe
5772	g_.exe
5652	t.exe
5980	g.exe
5628	e.exe
6332	aj10C7.exe
5364	Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
7076	assistant_installer.exe
6712	assistant_installer.exe
6800	cobstrk.exe
6392	jaf.exe
6892	pBglKrB.exe
2428	lGVpOSz.exe
5688	VnPNZcp.exe
6696	XtYgNnp.exe
6940	gxsnYou.exe
6644	zCAkLgV.exe
5952	NSHtlEB.exe
6196	QSSzOcM.exe
4412	mOuIKSt.exe
4264	YoEzzdQ.exe
7072	yySOBGM.exe
2608	LYSTzdz.exe
6464	UawjsoP.exe
6044	WxSZUYC.exe
6360	cfffITn.exe
6296	dSKGmLT.exe
6412	MoyszNw.exe
6388	GjODwUS.exe
7144	vVUVPkW.exe
6372	vEMOneA.exe
7120	HWhGYfx.exe

Loads dropped DLL 26 IoCs

pid	Process
5844	setup.exe
5720	avg.exe
5720	avg.exe
5872	telamon.tmp
6016	setup.exe
1192	setup.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5652	t.exe
5652	t.exe
5980	g.exe
5980	g.exe
5628	e.exe
5628	e.exe
5772	g_.exe
5772	g_.exe
5720	avg.exe
6332	aj10C7.exe
6332	aj10C7.exe
6332	aj10C7.exe
6332	aj10C7.exe
6332	aj10C7.exe
6332	aj10C7.exe
6332	aj10C7.exe
6332	aj10C7.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/6800-2084-0x00007FF68A000000-0x00007FF68A351000-memory.dmp	upx
behavioral1/files/0x0008000000023509-2099.dat	upx
behavioral1/memory/6892-2111-0x00007FF71C900000-0x00007FF71CC51000-memory.dmp	upx
behavioral1/memory/6696-2140-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp	upx
behavioral1/memory/5952-2150-0x00007FF7A76D0000-0x00007FF7A7A21000-memory.dmp	upx
behavioral1/memory/6644-2148-0x00007FF616630000-0x00007FF616981000-memory.dmp	upx
behavioral1/memory/4412-2153-0x00007FF644640000-0x00007FF644991000-memory.dmp	upx
behavioral1/memory/6464-2162-0x00007FF6BA520000-0x00007FF6BA871000-memory.dmp	upx
behavioral1/memory/6044-2165-0x00007FF719640000-0x00007FF719991000-memory.dmp	upx
behavioral1/memory/6296-2173-0x00007FF60B5A0000-0x00007FF60B8F1000-memory.dmp	upx
behavioral1/memory/6360-2172-0x00007FF6E74D0000-0x00007FF6E7821000-memory.dmp	upx
behavioral1/memory/6412-2179-0x00007FF6A5530000-0x00007FF6A5881000-memory.dmp	upx
behavioral1/memory/6372-2181-0x00007FF7A9600000-0x00007FF7A9951000-memory.dmp	upx
behavioral1/memory/7144-2180-0x00007FF66F5D0000-0x00007FF66F921000-memory.dmp	upx
behavioral1/memory/7120-2182-0x00007FF7ED7B0000-0x00007FF7EDB01000-memory.dmp	upx
behavioral1/memory/5688-2183-0x00007FF77B9C0000-0x00007FF77BD11000-memory.dmp	upx
behavioral1/memory/7072-2184-0x00007FF62D280000-0x00007FF62D5D1000-memory.dmp	upx
behavioral1/memory/6388-2185-0x00007FF7825E0000-0x00007FF782931000-memory.dmp	upx
behavioral1/memory/2608-2160-0x00007FF62DBA0000-0x00007FF62DEF1000-memory.dmp	upx
behavioral1/memory/4264-2159-0x00007FF749BC0000-0x00007FF749F11000-memory.dmp	upx
behavioral1/memory/6196-2152-0x00007FF707CE0000-0x00007FF708031000-memory.dmp	upx
behavioral1/memory/6940-2147-0x00007FF647CF0000-0x00007FF648041000-memory.dmp	upx
behavioral1/memory/2428-2136-0x00007FF67A0B0000-0x00007FF67A401000-memory.dmp	upx
behavioral1/memory/6800-2199-0x00007FF68A000000-0x00007FF68A351000-memory.dmp	upx
behavioral1/memory/6892-2205-0x00007FF71C900000-0x00007FF71CC51000-memory.dmp	upx
behavioral1/memory/2428-2207-0x00007FF67A0B0000-0x00007FF67A401000-memory.dmp	upx
behavioral1/memory/6940-2208-0x00007FF647CF0000-0x00007FF648041000-memory.dmp	upx
behavioral1/memory/6196-2209-0x00007FF707CE0000-0x00007FF708031000-memory.dmp	upx
behavioral1/memory/6696-2214-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp	upx
behavioral1/memory/6644-2215-0x00007FF616630000-0x00007FF616981000-memory.dmp	upx
behavioral1/memory/5952-2216-0x00007FF7A76D0000-0x00007FF7A7A21000-memory.dmp	upx
behavioral1/memory/4412-2217-0x00007FF644640000-0x00007FF644991000-memory.dmp	upx
behavioral1/memory/4264-2218-0x00007FF749BC0000-0x00007FF749F11000-memory.dmp	upx
behavioral1/memory/2608-2219-0x00007FF62DBA0000-0x00007FF62DEF1000-memory.dmp	upx
behavioral1/memory/6464-2220-0x00007FF6BA520000-0x00007FF6BA871000-memory.dmp	upx
behavioral1/memory/6044-2221-0x00007FF719640000-0x00007FF719991000-memory.dmp	upx
behavioral1/memory/6360-2222-0x00007FF6E74D0000-0x00007FF6E7821000-memory.dmp	upx
behavioral1/memory/6412-2223-0x00007FF6A5530000-0x00007FF6A5881000-memory.dmp	upx
behavioral1/memory/6892-2288-0x00007FF71C900000-0x00007FF71CC51000-memory.dmp	upx
behavioral1/memory/6644-2298-0x00007FF616630000-0x00007FF616981000-memory.dmp	upx
behavioral1/memory/6388-2291-0x00007FF7825E0000-0x00007FF782931000-memory.dmp	upx
behavioral1/memory/6696-2300-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp	upx
behavioral1/memory/4264-2319-0x00007FF749BC0000-0x00007FF749F11000-memory.dmp	upx
behavioral1/memory/6464-2320-0x00007FF6BA520000-0x00007FF6BA871000-memory.dmp	upx
behavioral1/memory/6412-2324-0x00007FF6A5530000-0x00007FF6A5881000-memory.dmp	upx
behavioral1/memory/6372-2326-0x00007FF7A9600000-0x00007FF7A9951000-memory.dmp	upx
behavioral1/memory/7120-2322-0x00007FF7ED7B0000-0x00007FF7EDB01000-memory.dmp	upx
behavioral1/memory/6296-2316-0x00007FF60B5A0000-0x00007FF60B8F1000-memory.dmp	upx
behavioral1/memory/5952-2315-0x00007FF7A76D0000-0x00007FF7A7A21000-memory.dmp	upx
behavioral1/memory/6044-2314-0x00007FF719640000-0x00007FF719991000-memory.dmp	upx
behavioral1/memory/2608-2312-0x00007FF62DBA0000-0x00007FF62DEF1000-memory.dmp	upx
behavioral1/memory/6196-2311-0x00007FF707CE0000-0x00007FF708031000-memory.dmp	upx
behavioral1/memory/6360-2306-0x00007FF6E74D0000-0x00007FF6E7821000-memory.dmp	upx
behavioral1/memory/7072-2304-0x00007FF62D280000-0x00007FF62D5D1000-memory.dmp	upx
behavioral1/memory/6940-2302-0x00007FF647CF0000-0x00007FF648041000-memory.dmp	upx
behavioral1/memory/4412-2301-0x00007FF644640000-0x00007FF644991000-memory.dmp	upx
behavioral1/memory/5688-2297-0x00007FF77B9C0000-0x00007FF77BD11000-memory.dmp	upx
behavioral1/memory/2428-2293-0x00007FF67A0B0000-0x00007FF67A401000-memory.dmp	upx
behavioral1/memory/7144-2329-0x00007FF66F5D0000-0x00007FF66F921000-memory.dmp	upx

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	aj10C7.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\AVAST Software\Avast	aj10C7.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	avg.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\AVAST Software\Avast	avg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jaf.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\U:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	aj10C7.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\lGVpOSz.exe	cobstrk.exe
File created	C:\Windows\System\XtYgNnp.exe	cobstrk.exe
File created	C:\Windows\System\zCAkLgV.exe	cobstrk.exe
File created	C:\Windows\System\mOuIKSt.exe	cobstrk.exe
File created	C:\Windows\System\WxSZUYC.exe	cobstrk.exe
File created	C:\Windows\System\GjODwUS.exe	cobstrk.exe
File created	C:\Windows\System\vVUVPkW.exe	cobstrk.exe
File created	C:\Windows\System\VnPNZcp.exe	cobstrk.exe
File created	C:\Windows\System\gxsnYou.exe	cobstrk.exe
File created	C:\Windows\System\NSHtlEB.exe	cobstrk.exe
File created	C:\Windows\System\QSSzOcM.exe	cobstrk.exe
File created	C:\Windows\System\UawjsoP.exe	cobstrk.exe
File created	C:\Windows\System\vEMOneA.exe	cobstrk.exe
File created	C:\Windows\System\HWhGYfx.exe	cobstrk.exe
File created	C:\Windows\System\pBglKrB.exe	cobstrk.exe
File created	C:\Windows\System\LYSTzdz.exe	cobstrk.exe
File created	C:\Windows\System\cfffITn.exe	cobstrk.exe
File created	C:\Windows\System\MoyszNw.exe	cobstrk.exe
File created	C:\Windows\System\YoEzzdQ.exe	cobstrk.exe
File created	C:\Windows\System\yySOBGM.exe	cobstrk.exe
File created	C:\Windows\System\dSKGmLT.exe	cobstrk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rckdck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	telamon.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flydes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stopwatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aj10C7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P0lko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bundle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	is-QI1N3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butdes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butdes.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flydes.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	telamon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tt-installer-helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aj10C7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aj10C7.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4832	timeout.exe
1576	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2368	taskkill.exe
6672	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2860	notepad.exe
6448	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
4116	msedge.exe
4116	msedge.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe
5720	avg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5772	g_.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	taskkill.exe
Token: 33	1840	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1840	AUDIODG.EXE
Token: SeShutdownPrivilege	5824	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5824	msiexec.exe
Token: SeSecurityPrivilege	5560	msiexec.exe
Token: SeCreateTokenPrivilege	5824	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5824	msiexec.exe
Token: SeLockMemoryPrivilege	5824	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5824	msiexec.exe
Token: SeMachineAccountPrivilege	5824	msiexec.exe
Token: SeTcbPrivilege	5824	msiexec.exe
Token: SeSecurityPrivilege	5824	msiexec.exe
Token: SeTakeOwnershipPrivilege	5824	msiexec.exe
Token: SeLoadDriverPrivilege	5824	msiexec.exe
Token: SeSystemProfilePrivilege	5824	msiexec.exe
Token: SeSystemtimePrivilege	5824	msiexec.exe
Token: SeProfSingleProcessPrivilege	5824	msiexec.exe
Token: SeIncBasePriorityPrivilege	5824	msiexec.exe
Token: SeCreatePagefilePrivilege	5824	msiexec.exe
Token: SeCreatePermanentPrivilege	5824	msiexec.exe
Token: SeBackupPrivilege	5824	msiexec.exe
Token: SeRestorePrivilege	5824	msiexec.exe
Token: SeShutdownPrivilege	5824	msiexec.exe
Token: SeDebugPrivilege	5824	msiexec.exe
Token: SeAuditPrivilege	5824	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5824	msiexec.exe
Token: SeChangeNotifyPrivilege	5824	msiexec.exe
Token: SeRemoteShutdownPrivilege	5824	msiexec.exe
Token: SeUndockPrivilege	5824	msiexec.exe
Token: SeSyncAgentPrivilege	5824	msiexec.exe
Token: SeEnableDelegationPrivilege	5824	msiexec.exe
Token: SeManageVolumePrivilege	5824	msiexec.exe
Token: SeImpersonatePrivilege	5824	msiexec.exe
Token: SeCreateGlobalPrivilege	5824	msiexec.exe
Token: SeDebugPrivilege	6672	taskkill.exe
Token: SeDebugPrivilege	6392	jaf.exe
Token: SeBackupPrivilege	3304	vssvc.exe
Token: SeRestorePrivilege	3304	vssvc.exe
Token: SeAuditPrivilege	3304	vssvc.exe
Token: SeLockMemoryPrivilege	6800	cobstrk.exe
Token: SeLockMemoryPrivilege	6800	cobstrk.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3692	anti.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
5928	stopwatch.exe
5824	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5844	setup.exe
5720	avg.exe
6332	aj10C7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 4964	2724	P0lko.exe	90
PID 2724 wrote to memory of 4964	2724	P0lko.exe	90
PID 2724 wrote to memory of 4964	2724	P0lko.exe	90
PID 4964 wrote to memory of 3692	4964	cmd.exe	92
PID 4964 wrote to memory of 3692	4964	cmd.exe	92
PID 4964 wrote to memory of 3692	4964	cmd.exe	92
PID 4964 wrote to memory of 4840	4964	cmd.exe	93
PID 4964 wrote to memory of 4840	4964	cmd.exe	93
PID 4964 wrote to memory of 4840	4964	cmd.exe	93
PID 4840 wrote to memory of 2368	4840	cmd.exe	95
PID 4840 wrote to memory of 2368	4840	cmd.exe	95
PID 4840 wrote to memory of 2368	4840	cmd.exe	95
PID 4964 wrote to memory of 4116	4964	cmd.exe	100
PID 4964 wrote to memory of 4116	4964	cmd.exe	100
PID 4964 wrote to memory of 3240	4964	cmd.exe	102
PID 4964 wrote to memory of 3240	4964	cmd.exe	102
PID 4964 wrote to memory of 3240	4964	cmd.exe	102
PID 4116 wrote to memory of 1180	4116	msedge.exe	103
PID 4116 wrote to memory of 1180	4116	msedge.exe	103
PID 4964 wrote to memory of 4368	4964	cmd.exe	104
PID 4964 wrote to memory of 4368	4964	cmd.exe	104
PID 4964 wrote to memory of 4368	4964	cmd.exe	104
PID 3240 wrote to memory of 408	3240	butdes.exe	105
PID 3240 wrote to memory of 408	3240	butdes.exe	105
PID 3240 wrote to memory of 408	3240	butdes.exe	105
PID 4964 wrote to memory of 2960	4964	cmd.exe	106
PID 4964 wrote to memory of 2960	4964	cmd.exe	106
PID 4368 wrote to memory of 556	4368	flydes.exe	107
PID 4368 wrote to memory of 556	4368	flydes.exe	107
PID 4368 wrote to memory of 556	4368	flydes.exe	107
PID 4964 wrote to memory of 4832	4964	cmd.exe	108
PID 4964 wrote to memory of 4832	4964	cmd.exe	108
PID 4964 wrote to memory of 4832	4964	cmd.exe	108
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110
PID 4116 wrote to memory of 2968	4116	msedge.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6132	attrib.exe

C:\Users\Admin\AppData\Local\Temp\P0lko.exe
"C:\Users\Admin\AppData\Local\Temp\P0lko.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\!m.bat" "
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\anti.exe
    anti.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K fence.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\doc.html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe5fa346f8,0x7ffe5fa34708,0x7ffe5fa34718
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
      4⤵
      PID:6200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,247826552906348146,16511726287278431367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
      4⤵
      PID:3560
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\butdes.exe
    butdes.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\is-6COLB.tmp\butdes.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6COLB.tmp\butdes.tmp" /SL5="$20164,2719719,54272,C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\butdes.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:408
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\flydes.exe
    flydes.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\is-KEK8S.tmp\flydes.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KEK8S.tmp\flydes.tmp" /SL5="$2015C,595662,54272,C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\flydes.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:556
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\i.exe
    i.exe
    3⤵
    - Executes dropped EXE
    PID:2960
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4832
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\gx.exe
    gx.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\7zS4E5BCFA7\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS4E5BCFA7\setup.exe --server-tracking-blob=MzY5Njg4ZTc1OTE1MjcyMTMxZmYwZTk4ODU3ZWE4Mjk0NjQ0Nzc5MjcxMWY4OGZhOThlNTU5YmNlNzA1NmJiOTp7ImNvdW50cnkiOiJOTCIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9OTF9VVlJfMzczNiZlZGl0aW9uPXN0ZC0yJnV0bV9jb250ZW50PTM3MzZfJnV0bV9pZD0wNTgwYWM0YWUyOTA0ZDA3ODNkOTQxNWE0NWRhZGFkYSZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRnJ1JTJGZ3glM0ZlZGl0aW9uJTNEc3RkLTIlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZ1dG1fbWVkaXVtJTNEcGElMjZ1dG1fY2FtcGFpZ24lM0RQV05fTkxfVVZSXzM3MzYlMjZ1dG1fY29udGVudCUzRDM3MzZfJTI2dXRtX2lkJTNEMDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEmdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9MDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEmZGxfdG9rZW49NzAwOTYzNzgiLCJ0aW1lc3RhbXAiOiIxNzI1ODAyMjIzLjgwMDQiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI4LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEyOC4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9OTF9VVlJfMzczNiIsImNvbnRlbnQiOiIzNzM2XyIsImlkIjoiMDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI0ODkyOGFmMC1jZDc3LTQ0NDctYTQyNy1kNzY5ODRmOGQ5NGMifQ==
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E5BCFA7\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4E5BCFA7\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.115 --initial-client-data=0x31c,0x320,0x324,0x2f8,0x328,0x6f571b54,0x6f571b60,0x6f571b6c
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409131155411\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409131155411\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409131155411\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409131155411\assistant\assistant_installer.exe" --version
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409131155411\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409131155411\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x24c,0x250,0x274,0x248,0x278,0x9e4f48,0x9e4f58,0x9e4f64
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6712
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\bundle.exe
    bundle.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5620
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\rckdck.exe
    rckdck.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\is-47P5C.tmp\is-QI1N3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-47P5C.tmp\is-QI1N3.tmp" /SL4 $302D8 "C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\rckdck.exe" 6123423 52736
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\avg.exe
    avg.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\aj10C7.exe
      "C:\Users\Admin\AppData\Local\Temp\aj10C7.exe" /relaunch=8 /was_elevated=1 /tagdata
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Checks SCSI registry key(s)
      Suspicious use of SetWindowsHookEx
      PID:6332
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\telamon.exe
    telamon.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\is-0I30I.tmp\telamon.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-0I30I.tmp\telamon.tmp" /SL5="$200C8,1520969,918016,C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\telamon.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5872
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-SG78D.tmp\tt-installer-helper.exe" --getuid > "C:\Users\Admin\AppData\Local\Temp\is-SG78D.tmp\~execwithresult.txt""
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\is-SG78D.tmp\tt-installer-helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-SG78D.tmp\tt-installer-helper.exe" --getuid
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5560
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-SG78D.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\telamon.exe > "C:\Users\Admin\AppData\Local\Temp\is-SG78D.tmp\~execwithresult.txt""
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\is-SG78D.tmp\tt-installer-helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-SG78D.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\telamon.exe
        6⤵
        Executes dropped EXE
        
        PID:5572
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\stopwatch.exe
    stopwatch.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5928
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\gadget.msi"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5824
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\g_.exe
    g_.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5772
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\t.exe
    t.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5652
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\g.exe
    g.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5980
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\e.exe
    e.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5628
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h C:\GAB
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\dng.html
    3⤵
    PID:212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5fa346f8,0x7ffe5fa34708,0x7ffe5fa34718
      4⤵
      PID:5512
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K proxy.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6672
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" "C:\GAB\24259.CompositeFont"
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:2860
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\GAB\24259.ini
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:6448
- - C:\Windows\SysWOW64\fontview.exe
    "C:\Windows\System32\fontview.exe" C:\GAB\24259.ttc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3988
- - C:\Windows\SysWOW64\fontview.exe
    "C:\Windows\System32\fontview.exe" C:\GAB\24259.TTF
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6680
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\cobstrk.exe
    cobstrk.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:6800
  - - C:\Windows\System\pBglKrB.exe
      C:\Windows\System\pBglKrB.exe
      4⤵
      Executes dropped EXE
      PID:6892
  - - C:\Windows\System\lGVpOSz.exe
      C:\Windows\System\lGVpOSz.exe
      4⤵
      Executes dropped EXE
      PID:2428
  - - C:\Windows\System\VnPNZcp.exe
      C:\Windows\System\VnPNZcp.exe
      4⤵
      Executes dropped EXE
      PID:5688
  - - C:\Windows\System\XtYgNnp.exe
      C:\Windows\System\XtYgNnp.exe
      4⤵
      Executes dropped EXE
      PID:6696
  - - C:\Windows\System\gxsnYou.exe
      C:\Windows\System\gxsnYou.exe
      4⤵
      Executes dropped EXE
      PID:6940
  - - C:\Windows\System\zCAkLgV.exe
      C:\Windows\System\zCAkLgV.exe
      4⤵
      Executes dropped EXE
      PID:6644
  - - C:\Windows\System\NSHtlEB.exe
      C:\Windows\System\NSHtlEB.exe
      4⤵
      Executes dropped EXE
      PID:5952
  - - C:\Windows\System\QSSzOcM.exe
      C:\Windows\System\QSSzOcM.exe
      4⤵
      Executes dropped EXE
      PID:6196
  - - C:\Windows\System\mOuIKSt.exe
      C:\Windows\System\mOuIKSt.exe
      4⤵
      Executes dropped EXE
      PID:4412
  - - C:\Windows\System\YoEzzdQ.exe
      C:\Windows\System\YoEzzdQ.exe
      4⤵
      Executes dropped EXE
      PID:4264
  - - C:\Windows\System\yySOBGM.exe
      C:\Windows\System\yySOBGM.exe
      4⤵
      Executes dropped EXE
      PID:7072
  - - C:\Windows\System\LYSTzdz.exe
      C:\Windows\System\LYSTzdz.exe
      4⤵
      Executes dropped EXE
      PID:2608
  - - C:\Windows\System\UawjsoP.exe
      C:\Windows\System\UawjsoP.exe
      4⤵
      Executes dropped EXE
      PID:6464
  - - C:\Windows\System\WxSZUYC.exe
      C:\Windows\System\WxSZUYC.exe
      4⤵
      Executes dropped EXE
      PID:6044
  - - C:\Windows\System\cfffITn.exe
      C:\Windows\System\cfffITn.exe
      4⤵
      Executes dropped EXE
      PID:6360
  - - C:\Windows\System\dSKGmLT.exe
      C:\Windows\System\dSKGmLT.exe
      4⤵
      Executes dropped EXE
      PID:6296
  - - C:\Windows\System\MoyszNw.exe
      C:\Windows\System\MoyszNw.exe
      4⤵
      Executes dropped EXE
      PID:6412
  - - C:\Windows\System\GjODwUS.exe
      C:\Windows\System\GjODwUS.exe
      4⤵
      Executes dropped EXE
      PID:6388
  - - C:\Windows\System\vVUVPkW.exe
      C:\Windows\System\vVUVPkW.exe
      4⤵
      Executes dropped EXE
      PID:7144
  - - C:\Windows\System\vEMOneA.exe
      C:\Windows\System\vEMOneA.exe
      4⤵
      Executes dropped EXE
      PID:6372
  - - C:\Windows\System\HWhGYfx.exe
      C:\Windows\System\HWhGYfx.exe
      4⤵
      Executes dropped EXE
      PID:7120
- - C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\jaf.exe
    jaf.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K des.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1280

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x3dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4244

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GAB\24259.CompositeFont

Filesize
42KB

MD5
8f64a583b0823bfc2fdf7277e67b5e16

SHA1
f8029c828d0aef58f8818b866f1f7f1ec2f095b8

SHA256
b637a0f9031088d08147f397836fe1c16b15c70db696db4ddea05ec5b95b4f91

SHA512
e8c7941c8a42f6408b0071c7f0ea06a226757d3a07e3943738296c5dd5e5e60d682424182f0d788f42a5758f1c76ef1ec89901acc43799833234f09f3b4278a2

Download Submit
C:\GAB\24259.TTF

Filesize
298KB

MD5
9dd75a7f3eb1861b088186e8c9f2d721

SHA1
2b758761919bbac82a016c59199ffc8abbeec7e6

SHA256
df8d94382f73e6d2197b60653c3d55c28ab5cf127a82e65b8af4ed1b52fdc412

SHA512
64d0b93f8b67539f2359b0808855e787507637dd0c67fd6931cfbaf65a66fcb0cac394351c29e000f0df3cc560f49214bbc0e41b0a1a0f9308d8d5f9bf324c91

Download Submit
C:\GAB\24259.TTF

Filesize
64KB

MD5
095863e75b38911881d78bc844e540e4

SHA1
5f9a3520fb226df79ea6eed20fe4e9eb0fc94ae6

SHA256
2f299efe0e9100ca65a00390ecd976c9b562b6089cc2341fc20e7a9f01be3777

SHA512
bdfd387100d0fe46f5b631e0531e387f6da374f82fd5fa21af31202d60ef67d1011a76b2448815d2934f828b1f847139f3bcba4fd7e8711da64b9a88ec9b6af4

Download Submit
C:\GAB\24259.TTF

Filesize
640KB

MD5
09602909b2cc8156323291aea84b1d7b

SHA1
eaf64c4b8de21c8d1278ce3484745fd19588ef97

SHA256
81d946db50b93c9d8b5a144a0b157aee08a66e801ec1386e0afef1d7c92b3d13

SHA512
3cabda8e4d96bb7047ceb535cc09afa7dcabcbd3ef8a45d472868978771eddda38241d16a4f4704925251bb911422a959941fad6c3fdc8ceb412dd0c77a04d5a

Download Submit
C:\GAB\24259.TTF

Filesize
217KB

MD5
0723999ddc6b4b922ec011b475f07d9d

SHA1
03aafc4a9496cd07d35952efd101312f6328bb16

SHA256
1da9b5ace583a0a52e85280264d84917630ff6d600caea9a1b99cbd7e8b7c07f

SHA512
0b1d1b2b994368d391195aa3d59c4ff647d6744f4f2240dcbc059c0a444e3a1b22b397c8c146349fa5b4beab9ff3cae5ce09d5464d0e6b71fbda593be822b711

Download Submit
C:\GAB\24259.TTF

Filesize
320KB

MD5
60ec9509cf02e98e252b229b1827a944

SHA1
d42f25f2ca12b859b8655f6085948451f5e70710

SHA256
283c4e1a39dd636240ce05df4e12a1e80baacfb48c4b921dcc35b201259bce0b

SHA512
72a22da92632395bfd8a7763cb91ac8c13b7cbd74bcb2f4c2cb84dc51c94e0fa00a33ef9e4ce36d48bd8530a92f1cf7c180672b4d0c021aea5fd67314ba49b69

Download Submit
C:\GAB\24259.TTF

Filesize
3.0MB

MD5
8168a24b9b3d93f4b230a058e8330f79

SHA1
76bd550bc448b10e4812c86fa1c9b684f358bd0d

SHA256
8021204d2ed0e23fd8fa2d2ffddead89469aa27d61e0140f925d172db78165fb

SHA512
7b83794e11d3e169ff17f9ffd4bf7e4dc1c48f9a9f1dfa8ea913404d30b8bac51d2ed3348de88aa0f61e27fdf28f648653fb4dee14c8e3e75930564a145a21b2

Download Submit
C:\GAB\24259.TTF

Filesize
238KB

MD5
af116cc142b0786d0c7898103a0bcd12

SHA1
a1fa4d6d7a2ddd568e4c615091ea7fa405c7052d

SHA256
dfcc306777a594d2815368547dd897e2ac82aff8073e55d9e682569939e49b81

SHA512
e757178d9007e591ef5cbbf91454f362aec75d637b954d2bfbbfb2c4935280be5a00a53d3b5b1408ec0095c1ea482f255c4cc6508ef39c456cffe3374132b940

Download Submit
C:\GAB\24259.TTF

Filesize
64KB

MD5
d6478dbc2e84b8def5dc115dcda0b29d

SHA1
6a0e0f579e67cbd28ddaaf6f406704259609848b

SHA256
fa671b6fddedd57f158ab90b6aa6a7c33db6f41ab620db72b7ad1e57c38bda5f

SHA512
8903db3e4b29279c0f834b512244f6986e8052d23d265ab5a03f0d2970ffcd101632dbf0f73afcd814441c1e693eaa4221ea3fbaffebe5c5d44664d038e88857

Download Submit
C:\GAB\24259.TTF

Filesize
80KB

MD5
d9f147b4c366da5940876fd47992c4d2

SHA1
49e46c9cbc8f6c36a01fe032e18750c3a787c260

SHA256
9bcd6064e3b52fa30a347edd6e82506e2ec8b1602930b423c629a82c10468a5b

SHA512
4b045f8bc8729caeeb0543700d6d4d304ecb0cb2a57cd1cea3a36668021674cfe29427432b2ac27faba569007f794717b0a430f229aca0b1fdf2e76036c8b425

Download Submit
C:\GAB\24259.TTF

Filesize
34KB

MD5
9e2ee65661bee40438d514fe592bfcf8

SHA1
140a77e69329638a5c53dc01fbcfe0ce9ab93423

SHA256
ac9ee085920a3d8b076d5e0c61dc9df42c4bac28d1fc968344f9ceddb3972f69

SHA512
3b3c7ff00d8f12cea48008a2e95c194f7fc64ee96425a3cfefb8b65a9f7dad66fa16104ec1cf96ac6892426e5e8ab59dab91e3d56d76f58753b80f8ac48f2612

Download Submit
C:\GAB\24259.TTF

Filesize
836KB

MD5
380dc112b96d4f0c3729185824327dca

SHA1
b23a1ca5647c9d296950d379b16e3b7d94a026ed

SHA256
463d5845e4324580128cd981edbf3affb14d2f4d9a14ee55881db8b1874236c3

SHA512
219871dc79639deb9578a9412d309ad642ffc3d6a0c7595538522c23c6fe8acfdd3c61503a333539c3d06a91e5825d62ba7014951df996a73b0c5eae40c591b0

Download Submit
C:\GAB\24259.TTF

Filesize
161KB

MD5
28806fbbd48444f22edee13bddeef650

SHA1
7b28cb70206c9890e9601ee8d03236f84ed511c9

SHA256
21be61ff5289c2125dbb48e2a739fd4dd98c3e58b37abfc22cc0412dd8376d95

SHA512
e0867701e2f5816f5f7d889186f8db84bd92164a0e8046e464e66c700571456f4f15731f5eff7ab362dd80c4128bbf0adc926738265c64585563739bc4ac6849

Download Submit
C:\GAB\24259.TTF

Filesize
384KB

MD5
021ffb20058ff0ed5ab230cb6bbe0567

SHA1
81908db0a83153962db5f290bf04cc2a25a74708

SHA256
dbb9a2c50f4318bbf21230ebe81311510869e43721fdd142380bdf40980828d0

SHA512
4b9bcbbec0e46ec8ae3e7ec1b762b85fc0d4ac1f41e8d4267f96ab2c94b396a0d021f96bf459c1fa3b9345baa34674f36c034ce78b5aebd3dc7aed70567280b3

Download Submit
C:\GAB\24259.TTF

Filesize
287KB

MD5
82bd7555c2aa0f84e52572b4302e0131

SHA1
db8a678e01c37ff2e2da7ad3b097cab391c25e1a

SHA256
588f090ae3a6d31370457312683d14ee3a5bfbdaaa0a070b7c80225b55b23e78

SHA512
f2016856108281bd3ba4edb0b6343df298c6ee58ac36bf2d077b6be4841120601c8939d28accfe8d157a70b10904fda0432cb3dabb261e55667710d51ed168dd

Download Submit
C:\GAB\24259.fon

Filesize
5KB

MD5
a634e3a2b629ba56e2a50c0753ef6000

SHA1
5deab1df08b2b98f19f3ea5eadc3027b0e62c8d0

SHA256
49f01063a552f64b3c3aa5da994417b5a69eb2cc0c72b15a5a025ea01a9968e4

SHA512
801d9daf5d615e4bcadca7a4794174e507997bf2397c9b1e5464c9f8a57bfa00fd31ab6bbb2a1aeede71b4b445b2e9fcca828f002c4f92971495ca2075c8c9e0

Download Submit
C:\GAB\24259.fon

Filesize
5KB

MD5
21475b17405b86f37a2c15a1df2733b3

SHA1
e640903a5fa2a800a27b74c73a02ea855dcbd953

SHA256
6e7a86167874f989433a264345e5ea6c0e000861cbca8153858b23d7d35d5ecc

SHA512
5752f5cdd3d6e56de8d6382dced5b7425fead8cbdb21755fb504320157a4aad3a713fb8d5d4d52e843d60b0251b3c14ee6e7720824ace97b9fd8a5dbf7e0d8f0

Download Submit
C:\GAB\24259.fon

Filesize
9KB

MD5
1df49bfe3f5b35cc4cb4065dd8ed51bc

SHA1
48e801336e740e7b8cc27dd130c4dd798d5c1ad1

SHA256
739f0b71bd23f0d242fdd42d63644a02df436425d147d7ad6aadd389874387fe

SHA512
b82ff80bc41eaca266610002082277032f3c5321ee5a278f826d975ba381e8bd7f78e6f70b36de2e10e967abb767f096b24fcc7dfff99521a18d4b748ff5ee6d

Download Submit
C:\GAB\24259.fon

Filesize
10KB

MD5
8057f2e04b4bd79a17b06dd560d5403a

SHA1
aa932e01efd7aaef4af57a5cdf822e86216583de

SHA256
26a78fc33f8e190d01666e9a1f7d056e84d442f7bb3a85f150556d07d99080e0

SHA512
e6df4aed29540f4201ef0a92a8f23c7a68ffaa7d07000e7d843be0cfe7b03f62d786a94db6d808be266d3f69a55411044719181c807ab397afd541be32cf03d3

Download Submit
C:\GAB\24259.fon

Filesize
12KB

MD5
dcfe71d27bf49ba16fde0d1945bfb4a2

SHA1
86b3d8696b5da354ef42c8ab4a9d21cdaaf0dda1

SHA256
eacbfca9a5ef05a108ef5337c773d82a43398bb8ea177e5ebeef62934dd75811

SHA512
4da8efcfd4a77e230c61a527eb96b5193b9f5ddc0d476dfca8ce6ba7143ac5c8a1fd8b673cc2c7b554dae42ec01364a178f64532b6de17d44dce07b3089869c3

Download Submit
C:\GAB\24259.fon

Filesize
61KB

MD5
130439c2b3b54cc97e1e14e23450f65b

SHA1
648288f50556c035318acd4479bc62da0fa80758

SHA256
1cdc4a3e81ddbdf6c469f70ef39be80215f850134359b9eb04b4c8ffa04a915b

SHA512
b52012fa64bf4c43465b775e79bf7942a7dd98b4bc1a1b95550bbb0211163ab83de7edad282fc37450e3494876daabf6ecabc106d7b6356fe492579b913128e2

Download Submit
C:\GAB\24259.fon

Filesize
82KB

MD5
5972eeea7971170eb72cab2fc85c2b17

SHA1
d327d96bd78c5e851e065d053829abbb370c0c09

SHA256
9677467feb714a89de457e262ff6647708b7de66127671b77f7e1e92aa0c2f41

SHA512
c55c5217271f29bd3a7a130daa5e5711eff65630127f90112a26bb4ba3dbf416059f9424606bc1998ff4eec874c18767a395e20c3dc516a00079b2c5a7221ed3

Download Submit
C:\GAB\24259.fon

Filesize
89KB

MD5
91d7e6e9fb8c6e39233a01b949cff952

SHA1
d6d4940d4fe3bea94a8eefe8e1504926194c63ba

SHA256
578c2d1d5e4a5d8d41c409efce29cb2e41bb1697c8fc88ed0e8bef896aad70f7

SHA512
e00fbca96126a3fd0c8c08f95036ca831421634d71917023716a6bfcc4a132ea3a8f7f9869819b106fb8b202e4328e254730add372f7a9e987b315bcd069e2dc

Download Submit
C:\GAB\24259.fon

Filesize
12KB

MD5
40f8022c3fe4e1cc97bb794e1b519b3f

SHA1
7ff107451b67b2d432db4706c697a9391c13a6f4

SHA256
6b16818c057024f588f4f423cb1f50d24e092fca3c9b5c8c1943cf5b3ea70759

SHA512
08a85d0203a0534067538ba0c1f40273409f61f212269cb3095df1defc114ff007efcb4c3c4897a345cda17db16c98b88ae61100b9e4636862d26edb8a402ba3

Download Submit
C:\GAB\24259.fon

Filesize
6KB

MD5
8a5dbabcb9b11e3e0c527b93e69d5e4d

SHA1
c47add614ece5ed16ca456bac08b1f2cbaccfec9

SHA256
824ea3f5eabd9c3b8e0041e78935feb65545f58760ce0c47a0d938ad75f8e241

SHA512
ddcb3520d68321e6372630cb34473c7b310ffed1263cde8e1059837e63e42e7a7e644537044dee774e9ea3e912e485f2630bc106233e039ea925355ec29921c0

Download Submit
C:\GAB\24259.fon

Filesize
68KB

MD5
5e142e4d090d689cd44fa8fe9882a743

SHA1
0301f8c9422f933c9d7a65bbe4f7c45feb4fef24

SHA256
a23e6b523d0e3d16cd197e5a525e3f299144577dbdb860ab91e7c14652aad3d4

SHA512
23f77ca93a178d4fdecf54ca1cb6cbc8d6c816deddc630d90fcaa5f3d028a9db29301d32b200c70bcbeb94c8491bd44ffeef51233cfeb011e2081825b167ba16

Download Submit
C:\GAB\24259.fon

Filesize
17KB

MD5
08204b8185f06076e625401e4ad1dd40

SHA1
da572b8772aa5b717d481ede5550b402668e5da9

SHA256
81538026940fedac874529cf77980f0813c8a3ab3264e06bed007a280e224ce7

SHA512
0f6c45de3c40fd82b36c1535130501dc1221b75bedb9c9c1852065d9592dba301a1ab51f2c837cebfbc36b40c6ed41a5180f401b8561311522e24a805b37ce3e

Download Submit
C:\GAB\24259.fon

Filesize
7KB

MD5
eca154375c4641abba75c495db383e46

SHA1
5979d7032dda8121b4e7589133031cc688c4eb1f

SHA256
b7684755e0b5f51b8b7ce6b73e7b020e46f5d4bb37b7498f10ba3450801b8d31

SHA512
6eb952e5b036151fac4ac2adda401eafa3cc1f3c631b220439f9a4cbe4918af2242cde75bc107ec98509b519b6250ad223acdf8b1f5b519841f055d397e10852

Download Submit
C:\GAB\24259.fon

Filesize
5KB

MD5
b571b302ee40c68f83bc88c811d85792

SHA1
64db86ad57b05cff711a01e34bf03c57824d1d23

SHA256
70b6339cf8cd7f6fa5e16d2ce9f2adb98ce3f713b505deae020cd11918e461de

SHA512
b55e71f3783380c1df60ed7faead859831bb0decf278143da2f187bbf7d449ae2939fd7bacc61db83874d497d4d87b31672f9b10ef43d0e2550ae244d319a5ab

Download Submit
C:\GAB\24259.ttc

Filesize
957KB

MD5
69477e688bc7ba8aed8d51c638cdf46d

SHA1
1c8b1b7055d62bcfa1f39548fa4c9904d0e1865c

SHA256
9ba07e98c2dfe00c7f00a44cc74da52a9818d39988a105c6af6974a63d04b9ad

SHA512
fd0f8b61b27df49e5705ac46436d888f55f2905e85873278ab3e41e5cfbc72701a6324dd46b2554592e7b0c22042a5903ee6896a874d1829c0bb682d9276b880

Download Submit
C:\GAB\24259.ttc

Filesize
13.0MB

MD5
e868c731ec770c425dbc74881b3ca936

SHA1
a8dc99a2e0bc3360f8441243aab13fe7279a759a

SHA256
1e5a4b342c6417bb9352e8c29cb839413987a06438e7b48fd0320925827f289c

SHA512
51bbdbcd06bc41c1ef6a589ca2b6300f1f9350d11b8bfa60605c7a68a0d6a714998bec6060cbc3b27dd2d1485d57f344890b0278d7313dbdb5593334ceea3b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
75bca6bfb0bb3e0058d2f0994778e67b

SHA1
309a9b7fd2c5602d3a527fd84325d3839edbd59c

SHA256
21996c4dc51d26e660d14d0fc540bbdc2486bf12eb65fd22a9228702c4518995

SHA512
f25985f4c724d788632b78074944efeb7ddd5f431c04b1f347bf70539dada5f0f067d1feb45eaa1645ea0841e5581d2c555c7527d7a8139c6eab5d5e67ad3fca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
48ddad856532b266bf6a5a99ee9bae4d

SHA1
0488981588a6bff0f0d973dab2ea3d5f8c0ffa9a

SHA256
7e377dbb73214161f1e09f839215922851c9ee455ad7d532f46ce55d59befe8e

SHA512
14fdfb4463274b1fe732e7139829505f54aa96fb11eca1b660246142f04dbb02d17052ea6cb9ecc8e36cc86583accacc657718413a65a9e57b64aa462a081514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
9aec607e5ef38a72fa53aac97a531cd7

SHA1
88f92008a8cfdbe38f9e942e7494c1a5489ad682

SHA256
8f74c106674f4aa1be1eb76f607b394b8c5156d1e1171a97f824b1570a337b19

SHA512
0180825faa8f41929d9c3df877cd9228a8085388915e2fe5b8db3d0243c066fd591b4290e11dab125223f5057fe2e1c18999a8ee03f72f156f56cab0777706d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2bad323c-4d8d-4a66-899c-397c0ed19b00.tmp

Filesize
3KB

MD5
5564b392a8ddb7ff69abeb0d7d56a3cd

SHA1
2a3d6719b1f71814a22f6315c22e264b9366aa95

SHA256
96fa769243a5363be3b1e25a0b89fa4f52d58b55bc8db2aefd11c63941f9aeb2

SHA512
9571af3dbd707c33c56df0938072025ed69ef966dc40fd332c19eeb59a21fa770a56e7073510f09ba56d3527c9652cbdd5b7b4cb7ad7cfe7db3e085f38fae6f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
d22708c93804608d8c3015d85ce05dbb

SHA1
80cd71061c9beaf093772f16380f2ad1af17cd58

SHA256
79b6afe162637996b840fc0cc63429a94a15fba04c90c3e41296036b166eaedb

SHA512
b55ef0790ebfdc0c1433730673716e3da5295b4612cdc33014dd7b92e6fd4e56470066a91e29445f9f1cd84cc0e205a9845e99865addea69b5da8fcb2ab4581b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
3f6f9239d6a4c4a3dab9a75c43d29f78

SHA1
0ef1f9ce04f15ddf5688eab572bdbfca7125246f

SHA256
b9aaecfa95b72b9e8f0661ee65b6d1923f5d5543ff4801a7413f5c11391e4740

SHA512
2c45851ea7dbdd070aa896143bbc447ae674f5a4f2a283f16414d5acfc85c9ed503a662af4ba7bf6476179a2d3d89ec89221007ab8e43dbf90744a61cad0e2de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
faa736d99dfc442eaf63b7f381e41524

SHA1
bd2cdf94e58b9ac091ff168d93d5d1eb76642498

SHA256
086e4904b1942b9492c34c12714f79b077cc29664017b85c7bf088eae513c8d5

SHA512
e8172804d17629abbe77c6219ee41cc06a474006b6b0b605cb25b2c7e98622dd7382a9589372491f3e4251cb9aa8d9ed6bab3f2d479831271aec90ab6fd10775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fb2eae32a09ca49f18feb88c81a16143

SHA1
b210f9dce8ebaced6809731038e8c425fd81b86e

SHA256
f5ce0147b57fe2f40021db04c6394c06ff73fa4c12fd1cee7bf26d6f90fc48b1

SHA512
c848e2c25b5efb8b21d848a2392955efb864a8184902535ba03a453584a42574008649630f7bb33789ca0f0d17a14addf479ceaca4c2a4410a41b61c0ba79f9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
828d15cd9f6dc5ff954521e1f779d998

SHA1
e1107df2efe2ed85e4f6b35e0aa05c41df664c89

SHA256
47f67d6ad19ab4e0cec6d92a0ec6dc09a3b2f2074bb8bc69fa69fcb924de1a80

SHA512
ad445db683f7a0a79d3f1ab4e7aee46e9d180eb5282c3ac3798760a6f7ab79b59b4f904bfcf04ee95ac05bf078afb7426d44f5ac1d29a43a4c8ff07981d70f81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5a609cfde3b60ad7f9bf57e626fc746

SHA1
f3c958f6415c0ff235133b5dc861e8795df22cae

SHA256
dd9aed4de7eabb7618a927998ddc890418e50184d03da563a8a6c8db58d58144

SHA512
7a4c6f7397ec79212aa4d52c94e2c428ab158cc83b3dbdc2030752d49c0f4f3e55bf2c4fa6fdbd5cad77b915b5cdea4b1cc8c292994c0442abc2d4eca779a457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f754a9f5496b5bcd75e8c95b9efcd666

SHA1
15c2e9b59f40dd089a2cf613d4e73669eea7ef98

SHA256
1504f19abc80814d18f0781d138c27a70588240377527d5d6536afe882bd2ce4

SHA512
10fdb40580a37fce3c218f0e8c62b217e23b813b5058db7f4d5e9a7da99960edf5d27d692ce39c4cb7c44263ce6f9b7c0e2ff8087e63d5626d87b1376c2dfa44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c0e0b861c44144dc72b50f202c6a099f

SHA1
fd9ba8e848fd1ffb5dcf2be0df1ccca984ab58fa

SHA256
7faa1c82d4f1218f5d31e5d32c217e47a3679e282969255e8e49dcdd2504a3e8

SHA512
afccc3191f8702ba5587addddcc486204b40a235f446d46f769625615589ad7a6d9f0796d276dc15f26210e318331f57cb19cf06268a8a3c2eacec5fc41816cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1ccb1bd59980164a2a188bff8f90e947

SHA1
603790d52bfc5c97f2623d19cec4aa9f68b05cc1

SHA256
8df8e24745982f4ee69c110ec8620cf61369e94536d54995919de768c5f88a55

SHA512
60e83588767b0883eca39b57a03a110a170d18f4e6d9371fe1d62429b65e9c85f9db53cc505e4dd479b6d0c8b8b9ec2a9ac7bac4d77aeb99eb842925ecb3262f

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409131155411\additional_file0.tmp

Filesize
1.4MB

MD5
e9a2209b61f4be34f25069a6e54affea

SHA1
6368b0a81608c701b06b97aeff194ce88fd0e3c0

SHA256
e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

SHA512
59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E5BCFA7\setup.exe

Filesize
6.4MB

MD5
defd30ea336650cc29c0c79fad6fa6b5

SHA1
935d871ed86456c6dd3c83136dc2d1bda5988ff3

SHA256
015a13bd912728e463df6807019b1914dffc3e6735830472e3287150a02e13f4

SHA512
8c6ebbf398fb44ff2254db5a7a2ffbc8803120fa93fa6b72c356c6e8eca45935ab973fe3c90d52d5a7691365caf5b41fe2702b6c76a61a0726faccc392c40e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2409131155410115844.dll

Filesize
5.9MB

MD5
640ed3115c855d32ee1731c54702eab7

SHA1
1ac749b52794cbadfec8d9219530e9a79fc9427c

SHA256
29b4cabc7a0e9dffbc2395b976749be0aad88357dd3b1d7e0cfc9b0c645421a3

SHA512
bebe55fdbb363b78c4a6371304f65b89e03a03cee5a8ebceee1681261d8df64a0de36888ed763c3a607ae2732ab54e2e41edb624f37a7fdf8755c40e6bb96f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\!m.bat

Filesize
824B

MD5
34668f54b0b37f99ad7cac2b2dfc143c

SHA1
191f0593c1567e21d2bc3f6e426a6105b45fa048

SHA256
7073d936dcf38170c8d0d3ca33130c70920bfe304650621dd1ed18b9e2e1829f

SHA512
64313be755d28f660fcd27fb9e813e94d906b26f1451c9d8a5b4970b210e69b5d27f2e51d1b14f0574f349f29a5db498c3c9072e3a5bea7f86c2ad9f4856a892

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\anti.exe

Filesize
1.9MB

MD5
cb02c0438f3f4ddabce36f8a26b0b961

SHA1
48c4fcb17e93b74030415996c0ec5c57b830ea53

SHA256
64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32

SHA512
373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\avg.exe

Filesize
5.8MB

MD5
0dc93e1f58cbb736598ce7fa7ecefa33

SHA1
6e539aab5faf7d4ce044c2905a9c27d4393bae30

SHA256
4ec941f22985fee21d2f9d2ae590d5dafebed9a4cf55272b688afe472d454d36

SHA512
73617da787e51609ee779a12fb75fb9eac6ed6e99fd1f4c5c02ff18109747de91a791b1a389434edfe8b96e5b40340f986b8f7b88eac3a330b683dec565a7eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\bundle.exe

Filesize
429KB

MD5
ae4581af98a5b38bce860f76223cb7c9

SHA1
6aa1e2cce517e5914a47816ef8ca79620e50e432

SHA256
7c4b329a4018dc7e927a7d1078c846706efae6e6577f6809defaa51b636e7267

SHA512
11ad90a030999bbb727dbfde7943d27f2442c247633cde5f9696e89796b0f750f85a9be96f01fa3fd1ec97653a334b1376d6bb76d9e43424cabe3a03893ecf04

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\butdes.exe

Filesize
2.8MB

MD5
1535aa21451192109b86be9bcc7c4345

SHA1
1af211c686c4d4bf0239ed6620358a19691cf88c

SHA256
4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6

SHA512
1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\code.js

Filesize
4KB

MD5
016bf2cf2bad527f1f1ea557408cb036

SHA1
23ab649b9fb99da8db407304ce9ca04f2b50c7b4

SHA256
17bb814cfaa135628fd77aa8a017e4b0dcd3c266b8cdca99e4d7de5d215643c0

SHA512
ac2d4f51b0b1da3c544f08b7d0618b50514509841f81bc9dad03329d5c1a90e205795a51ca59522d3aa660fb60faae19803eceeeea57f141217a6701a70510e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\doc.html

Filesize
15KB

MD5
5622e7755e5f6585a965396b0d528475

SHA1
b059dc59658822334e39323b37082374e8eeaac4

SHA256
080cb8ef0cbf5a5de9163b365eec8b29538e579f14a9caa45c0f11bc173c4147

SHA512
62f5abda3473ca043bf126eed9d0bcc0f775b5ac5f85b4fe52d1d656f476f62188d22cf79b229059a5d05e9258980c787cb755f08ca86e24e5f48655b5447f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\download.jpg

Filesize
8KB

MD5
01a5131931ef35acecbe557ba13f3954

SHA1
c7afc7590d469432704d963ffcee31ad8bcfc175

SHA256
d364872ddde28d81d23bb3b08f9e86f921b542f3a35fcaf12549cf5666462bd0

SHA512
ce32352484d676bd0f47c24808707c603fe9f09e41afd63d90f07599f13a5e32c73b0970a9964632f76f5843dda87a033340ee12fadd87b9f219329d0c69b02e

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\fence.bat

Filesize
167B

MD5
6465a5431e01a80bf71aca9e9698e5b0

SHA1
d56ed108f13a6c49d57f05e2bf698778fd0b98dc

SHA256
1c5f05fecfc1f4fd508f1d3bbb93a47e8b8196b9eded5de7152a6fa57ca7580f

SHA512
db7f64b8af595d0bf6fd142471868df6d29ec7cfbb49a7e0da63d9bc8ca8f319e4c41f2c7baeafe17a3679861163400ccb36c18617982b244aaf482e9c264e55

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\flydes.exe

Filesize
833KB

MD5
b401505e8008994bf2a14fdf0deac874

SHA1
e4f7f375b1e88dd71a0274a997ed5d9491bde068

SHA256
6bcf6b84d71737787e3cc8d9d0eed9720f388cc2d0337832a7e8ca3c6f455a41

SHA512
1bca98547ecf5a98d42b1d77cff50ca79ee560c893b2470aeb86887fef6e40a5ccdb72956f04a1d2a862827eebd3b7746e3043f3e6209597dcde9385ed55cc11

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\fries.jpg

Filesize
12KB

MD5
c4d9d3cd21ef4de91abc95f99c4bc7dc

SHA1
b2cf457237c44c824068727b8440fe6a352a360c

SHA256
6fd1c3bde9a6a478e39d1cf2121e980c0bcf59454fe1673d707aa70170953bc9

SHA512
d10fbb0bdfb30160484950aa58bd2f97c38cf2d0914550b4041c9acd273e8013920ef1ee74216f92437a44ab81111a4c70ed3dc2df680ee4d187c22557900ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\g_.exe

Filesize
69KB

MD5
3cb72c753dd5e198792d1e0be81f7e2b

SHA1
8a55b72a998bf8362a12f68ee8c4801a5a24754c

SHA256
be9d8772b360ca8054929e5f057413b69932ca8e521e6c696e0fb6b371e8cb97

SHA512
008ed2e26fb4f41e9bb245130cc8f285744ccf737adeffc4c78cb11c03261f906cfd50b5b9e78f2c17dc2b8a01d83554e93f4960370064af87e84322cc78ee70

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\gadget.msi

Filesize
23.4MB

MD5
906ad3937f0abd2e5383dc162340496b

SHA1
d63fe621af79e1468ee0cf52e119ffd21775ca8a

SHA256
821e33cf757bd01bec6703796c01726e6674b8de3bc1e7ea834318039e46909e

SHA512
624d76f7905f57679b647cfc676aa8c55cac72d6baa60db7d5ae45662de5da55f856f64adca382b315810088e757903f6c051685fcc83fe330016a8a95754d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\gx.exe

Filesize
3.1MB

MD5
80bf3bf3b76c80235d24f7c698239089

SHA1
7f6071b502df985580e7c469c6d092472e355765

SHA256
2b95e56af10406fbd3ecee38dab9e9c4a9b990d087f2ad2d7b1981c087829da2

SHA512
076b8b6a80ea15738ce682cc715792546582d7a74f971f94f6b5b9cf8164f01280322baec7f72894ac4b8d63b9f2f6074e8fc5e47880ef6c0b57a47beef3581a

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\i.exe

Filesize
12KB

MD5
cea5426da515d43c88132a133f83ce68

SHA1
0c224d0bb777f1e3b186fdf58cc82860d96805cc

SHA256
2be7a0865ded1c0bd1f92d5e09bb7b37a9e36a40487a687e0359c93878611a78

SHA512
4c1f25147222c84dff513bebf00e828719454ad634ef9380cfc7835f0457a718b4b437ecb60c1fa72a7f83fbb67e1ddfcd225194eedda77034c72f8c752c642c

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\images.jpg

Filesize
13KB

MD5
49f4fe0c8646909c7cf87adf68d896fd

SHA1
9193264c38e5ed9fa0f5be1d79f802cf946a74cf

SHA256
9292dfcddc9e88e5dbc095ceeb83ce23400a3405a4d47fffc80656941c87d5ec

SHA512
9df4db8c958110cea66f627170919346ed673d3c13aa55292484fc74ebac2864b0292cd4d66d35957b4b2740b2fe30ddfb9d9e04115d655fb58bf39e100d285e

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\nuggets.webp

Filesize
32KB

MD5
e40209599b592630dcac551daeb6b849

SHA1
851150b573f94f07e459c320d72505e52c3e74f0

SHA256
3c9aefa00fb2073763e807a7eccac687dcc26598f68564e9f9cf9ffdcd90a2be

SHA512
6da5895f2833a18ddb58ba4a9e78dd0b3047475cae248e974dc45d839f02c62772a6ba6dfe51dd9a37f29b7ec9780e799f60f0e476655006dec693164e17eec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\rckdck.exe

Filesize
6.2MB

MD5
a79fb1a90fb3d92cf815f2c08d3ade6d

SHA1
25e5e553af5e2d21b5cfc70ba41afb65202f6fd5

SHA256
43759b0c441fd4f71fe5eeb69f548cd2eb40ac0abfa02ea3afc44fbddf28dc16

SHA512
82aa45337987c4f344361037c6ca8cf4fbf0fc1e5079ac03f54f3184354792965f6f3b28bd2ab7b511d21f29859e2832fc6b6122a49ddecde12afc7e26fd62dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\stopwatch.exe

Filesize
68KB

MD5
338a4b68d3292aa22049a22e9292e2a2

SHA1
9595e6f6d5e18a3e71d623ac4012e7633b020b29

SHA256
490d833205f9dfe4f1950d40c845489aa2d2039a77ab10473384986f8442ea6f

SHA512
06bc6463b65508d050c945d5bf08078eecd6982c74c7bab2a6722b99523189d24f530c10c05577e0dbd5b46e896d472112d036023ef5e576e2a8f9401b8668a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\t.exe

Filesize
62KB

MD5
9e0c60453cdea093fa4c6762f9b1fda9

SHA1
02dfa74e42739c4e8a9a0534273f6a89b51f1dd3

SHA256
269c6da90935306778f4f76005d1f00b49703f8819b60e2764cc14a5abc9a781

SHA512
fc499cb6b98529c7a856c9ec7198f2a6d00d0c0d6b16e826913ab8dca2602f6700e3956749d3316484b94e6867f54cf99aa77f23375ea6c5ea75daa88c91aa96

Download Submit
C:\Users\Admin\AppData\Local\Temp\P0lko_9bc12658-b7e7-4011-bdb5-a1c8f5fe0f0d\telamon.exe

Filesize
2.3MB

MD5
6a80889e81911157ca27df5bc5ac2e09

SHA1
02ac28dd7124317e294fac847a05b69411c9cdb2

SHA256
0b74c13914f712fce5bb41c25a443c4214a97792bdbb6fea05b98350901405ff

SHA512
329ec105834f4531386090074994e5c4ddbdaf4cc4801956b675e258e9167f9e70cf31b8d636d119b59b57af0912decdc259d12999842008cec807a967c89aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0I30I.tmp\telamon.tmp

Filesize
3.1MB

MD5
292d91bef15a5a5d5f5c06425a96e0ee

SHA1
5f4400c94ceebf54825e94cb5d9f616850331e96

SHA256
b6f6cbd03951a6feee4d4766443ce0b7623db000cbfe774146ee43f5a5831373

SHA512
0aca0538ce4c94ef9a8008846add36f51db001905f6cdb373a0348094f11762269aaf92928c6761eb41b1b22cd045ece325b9cd71c67944a1e6c092a72fca200

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-47P5C.tmp\is-QI1N3.tmp

Filesize
659KB

MD5
5aa68bb2bf3b994bda93834ad34e7963

SHA1
0156732d5dd48feacfab3aa07764061d73b9116c

SHA256
a90bfd9874c3e60650dba4c286b97ccdb375a456b95556feb38f3cba214770aa

SHA512
e52fecbba96aa911552ef0e11d5d044ec44caf6e0947f64c9a17b04d846a3e86d19e4dfa5ac981fc98d44f941fda3a697c1d23ac6e8ef162f4bcdde9142f22f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6COLB.tmp\butdes.tmp

Filesize
688KB

MD5
c765336f0dcf4efdcc2101eed67cd30c

SHA1
fa0279f59738c5aa3b6b20106e109ccd77f895a7

SHA256
c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

SHA512
06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SG78D.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SG78D.tmp\tt-installer-helper.exe

Filesize
404KB

MD5
5b4c8e63be988b83b09e13e9d1d74bb9

SHA1
bcb242f54ee83f232df6b871aebc0f3d44e434c6

SHA256
8ae877bd5f45975d827280bee2e19021c3401b5ba069df0e556f6911798adb4d

SHA512
a31f9e24a4a27847516808b24f312d4df6b865eb421f84d8d4fc022bdb309e08e5648c52c13772a48456c578f3771d232539c7d30132a82a08e8ebbabcbffa0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SG78D.tmp\~execwithresult.txt

Filesize
77B

MD5
1457e721bf4afed6937c8066752bd5ed

SHA1
9d0c8ba767343a00aac5d1f6993d22b86349782b

SHA256
9a3df8721d3e5ddae131bf508b7680fa7207bb2dcfde8a47f4916462b58d06e5

SHA512
ede635f10e6ee6ba3eb87469bf3dd8c89fafddf602297836e7542ea2f15d7db4ea1f70845c5806e936a1abb51c7eadbcb804d7baa0ca4d30de0044a9d28ea97a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl151B.tmp\CR.History.tmp

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl151B.tmp\CR.History.tmp

Filesize
124KB

MD5
66dd6d1464df4370c14aca9d08613e68

SHA1
2e8386dacd0c2f32bb90aefd18d4086534addad3

SHA256
ffb27b64184a44f0d3484a1515c5e09dd1b2dcf00465ac01feecc83619b50614

SHA512
2df122eb81713f0dca53e8c09517ad20cf2620fb1baa28b53b1d7c0dfc4191d14874a22ebbf61535832ce91fc0b0989e120c3ba6f28e46ac8634147571310482

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl151B.tmp\FF.places.tmp

Filesize
5.0MB

MD5
81412f7f844b75a6c65ed71eac0b9e61

SHA1
39b14eb48e13daaf94023482666fc9e13118ba72

SHA256
e37ca7753860c60248b70828432c8e018a3788479808fdfdbc4d3b369b381019

SHA512
63f2f6af6974091fb8de9dae945b392bb5f68abe66f7d9e3906089bb31f8e7ae2be03fcce44288514678b2b79eb309667b4607e9132183d1bb9a631ad65a983a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl151B.tmp\Midex.dll

Filesize
126KB

MD5
2597a829e06eb9616af49fcd8052b8bd

SHA1
871801aba3a75f95b10701f31303de705cb0bc5a

SHA256
7359ca1befdb83d480fc1149ac0e8e90354b5224db7420b14b2d96d87cd20a87

SHA512
8e5552b2f6e1c531aaa9fd507aa53c6e3d2f1dd63fe19e6350c5b6fbb009c99d353bb064a9eba4c31af6a020b31c0cd519326d32db4c8b651b83952e265ffb35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl151B.tmp\thirdparty.dll

Filesize
93KB

MD5
7b4bd3b8ad6e913952f8ed1ceef40cd4

SHA1
b15c0b90247a5066bd06d094fa41a73f0f931cb8

SHA256
a49d3e455d7aeca2032c30fc099bfad1b1424a2f55ec7bb0f6acbbf636214754

SHA512
d7168f9504dd6bbac7ee566c3591bfd7ad4e55bcac463cecb70540197dfe0cd969af96d113c6709d6c8ce6e91f2f5f6542a95c1a149caa78ba4bcb971e0c12a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslFC05.tmp\JsisPlugins.dll

Filesize
2.1MB

MD5
d21ae3f86fc69c1580175b7177484fa7

SHA1
2ed2c1f5c92ff6daa5ea785a44a6085a105ae822

SHA256
a6241f168cacb431bfcd4345dd77f87b378dd861b5d440ae8d3ffd17b9ceb450

SHA512
eda08b6ebdb3f0a3b6b43ef755fc275396a8459b8fc8a41eff55473562c394d015e5fe573b3b134eeed72edff2b0f21a3b9ee69a4541fd9738e880b71730303f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslFC05.tmp\StdUtils.dll

Filesize
195KB

MD5
34939c7b38bffedbf9b9ed444d689bc9

SHA1
81d844048f7b11cafd7561b7242af56e92825697

SHA256
b127f3e04429d9f841a03bfd9344a0450594004c770d397fb32a76f6b0eabed0

SHA512
bc1b347986a5d2107ad03b65e4b9438530033975fb8cc0a63d8ef7d88c1a96f70191c727c902eb7c3e64aa5de9ce6bb04f829ceb627eda278f44ca3dd343a953

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslFC05.tmp\jsis.dll

Filesize
127KB

MD5
2027121c3cdeb1a1f8a5f539d1fe2e28

SHA1
bcf79f49f8fc4c6049f33748ded21ec3471002c2

SHA256
1dae8b6de29f2cfc0745d9f2a245b9ecb77f2b272a5b43de1ba5971c43bf73a1

SHA512
5b0d9966ecc08bcc2c127b2bd916617b8de2dcbdc28aff7b4b8449a244983bfbe33c56f5c4a53b7cf21faf1dbab4bb845a5894492e7e10f3f517071f7a59727c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslFC05.tmp\nsJSON.dll

Filesize
36KB

MD5
f840a9ddd319ee8c3da5190257abde5b

SHA1
3e868939239a5c6ef9acae10e1af721e4f99f24b

SHA256
ddb6c9f8de72ddd589f009e732040250b2124bca6195aa147aa7aac43fc2c73a

SHA512
8e12391027af928e4f7dad1ec4ab83e8359b19a7eb0be0372d051dfd2dd643dc0dfa086bd345760a496e5630c17f53db22f6008ae665033b766cbfcdd930881a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{14AF569F-D6B8-41F2-A7BD-47A59A63A6B2}\scrt.dll

Filesize
5.7MB

MD5
f36f05628b515262db197b15c7065b40

SHA1
74a8005379f26dd0de952acab4e3fc5459cde243

SHA256
67abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31

SHA512
280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8

Download Submit
C:\Windows\System\pBglKrB.exe

Filesize
5.2MB

MD5
5b71e1e4e20dd8e891d1a6ab9c1e6e21

SHA1
5e94f27f849916a92ca6b65538db3e3ac6065870

SHA256
78b8cb371d862bd88fb65b7b38b7039746bf7c7abd9dc065356b9c4f38122ff1

SHA512
944d07ab14a818e70d691e13778b205ef254c914b2bcee9d4f2e951b6c6861216bce8ad3331eac7993c0e9aa266a090af068bce359e9e256dc778d0234fe45b3

Download Submit
memory/408-506-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/556-507-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2428-2136-0x00007FF67A0B0000-0x00007FF67A401000-memory.dmp

Filesize
3.3MB

Download
memory/2428-2293-0x00007FF67A0B0000-0x00007FF67A401000-memory.dmp

Filesize
3.3MB

Download
memory/2428-2207-0x00007FF67A0B0000-0x00007FF67A401000-memory.dmp

Filesize
3.3MB

Download
memory/2608-2219-0x00007FF62DBA0000-0x00007FF62DEF1000-memory.dmp

Filesize
3.3MB

Download
memory/2608-2312-0x00007FF62DBA0000-0x00007FF62DEF1000-memory.dmp

Filesize
3.3MB

Download
memory/2608-2160-0x00007FF62DBA0000-0x00007FF62DEF1000-memory.dmp

Filesize
3.3MB

Download
memory/2724-2096-0x0000000074D70000-0x0000000075520000-memory.dmp

Filesize
7.7MB

Download
memory/2724-3-0x0000000074D70000-0x0000000075520000-memory.dmp

Filesize
7.7MB

Download
memory/2724-4-0x00000000055E0000-0x0000000005B84000-memory.dmp

Filesize
5.6MB

Download
memory/2724-0-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

Filesize
4KB

Download
memory/2724-163-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

Filesize
4KB

Download
memory/2724-218-0x0000000074D70000-0x0000000075520000-memory.dmp

Filesize
7.7MB

Download
memory/2724-2-0x0000000004CC0000-0x0000000004CE4000-memory.dmp

Filesize
144KB

Download
memory/2724-1-0x0000000000330000-0x000000000037A000-memory.dmp

Filesize
296KB

Download
memory/3240-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3240-504-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3692-49-0x00000000003C0000-0x00000000005B2000-memory.dmp

Filesize
1.9MB

Download
memory/3692-48-0x0000000074D70000-0x0000000075520000-memory.dmp

Filesize
7.7MB

Download
memory/3692-54-0x0000000074D70000-0x0000000075520000-memory.dmp

Filesize
7.7MB

Download
memory/3692-56-0x0000000005100000-0x0000000005156000-memory.dmp

Filesize
344KB

Download
memory/3692-55-0x0000000004EF0000-0x0000000004EFA000-memory.dmp

Filesize
40KB

Download
memory/3692-51-0x0000000004F70000-0x0000000005002000-memory.dmp

Filesize
584KB

Download
memory/3692-50-0x0000000004E00000-0x0000000004E9C000-memory.dmp

Filesize
624KB

Download
memory/3692-300-0x0000000074D70000-0x0000000075520000-memory.dmp

Filesize
7.7MB

Download
memory/4264-2218-0x00007FF749BC0000-0x00007FF749F11000-memory.dmp

Filesize
3.3MB

Download
memory/4264-2159-0x00007FF749BC0000-0x00007FF749F11000-memory.dmp

Filesize
3.3MB

Download
memory/4264-2319-0x00007FF749BC0000-0x00007FF749F11000-memory.dmp

Filesize
3.3MB

Download
memory/4368-66-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4368-505-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4412-2301-0x00007FF644640000-0x00007FF644991000-memory.dmp

Filesize
3.3MB

Download
memory/4412-2153-0x00007FF644640000-0x00007FF644991000-memory.dmp

Filesize
3.3MB

Download
memory/4412-2217-0x00007FF644640000-0x00007FF644991000-memory.dmp

Filesize
3.3MB

Download
memory/5628-339-0x00007FF709960000-0x00007FF709986000-memory.dmp

Filesize
152KB

Download
memory/5652-337-0x00007FF7B2820000-0x00007FF7B2847000-memory.dmp

Filesize
156KB

Download
memory/5668-160-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5668-597-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5688-2297-0x00007FF77B9C0000-0x00007FF77BD11000-memory.dmp

Filesize
3.3MB

Download
memory/5688-2183-0x00007FF77B9C0000-0x00007FF77BD11000-memory.dmp

Filesize
3.3MB

Download
memory/5728-666-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/5772-336-0x00007FF680A30000-0x00007FF680A59000-memory.dmp

Filesize
164KB

Download
memory/5772-711-0x00007FF680A30000-0x00007FF680A59000-memory.dmp

Filesize
164KB

Download
memory/5788-173-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/5788-667-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/5872-668-0x0000000000400000-0x0000000000729000-memory.dmp

Filesize
3.2MB

Download
memory/5952-2315-0x00007FF7A76D0000-0x00007FF7A7A21000-memory.dmp

Filesize
3.3MB

Download
memory/5952-2150-0x00007FF7A76D0000-0x00007FF7A7A21000-memory.dmp

Filesize
3.3MB

Download
memory/5952-2216-0x00007FF7A76D0000-0x00007FF7A7A21000-memory.dmp

Filesize
3.3MB

Download
memory/5980-338-0x00007FF7A99D0000-0x00007FF7A99F6000-memory.dmp

Filesize
152KB

Download
memory/6044-2221-0x00007FF719640000-0x00007FF719991000-memory.dmp

Filesize
3.3MB

Download
memory/6044-2314-0x00007FF719640000-0x00007FF719991000-memory.dmp

Filesize
3.3MB

Download
memory/6044-2165-0x00007FF719640000-0x00007FF719991000-memory.dmp

Filesize
3.3MB

Download
memory/6196-2311-0x00007FF707CE0000-0x00007FF708031000-memory.dmp

Filesize
3.3MB

Download
memory/6196-2209-0x00007FF707CE0000-0x00007FF708031000-memory.dmp

Filesize
3.3MB

Download
memory/6196-2152-0x00007FF707CE0000-0x00007FF708031000-memory.dmp

Filesize
3.3MB

Download
memory/6296-2316-0x00007FF60B5A0000-0x00007FF60B8F1000-memory.dmp

Filesize
3.3MB

Download
memory/6296-2173-0x00007FF60B5A0000-0x00007FF60B8F1000-memory.dmp

Filesize
3.3MB

Download
memory/6360-2222-0x00007FF6E74D0000-0x00007FF6E7821000-memory.dmp

Filesize
3.3MB

Download
memory/6360-2306-0x00007FF6E74D0000-0x00007FF6E7821000-memory.dmp

Filesize
3.3MB

Download
memory/6360-2172-0x00007FF6E74D0000-0x00007FF6E7821000-memory.dmp

Filesize
3.3MB

Download
memory/6372-2326-0x00007FF7A9600000-0x00007FF7A9951000-memory.dmp

Filesize
3.3MB

Download
memory/6372-2181-0x00007FF7A9600000-0x00007FF7A9951000-memory.dmp

Filesize
3.3MB

Download
memory/6388-2185-0x00007FF7825E0000-0x00007FF782931000-memory.dmp

Filesize
3.3MB

Download
memory/6388-2291-0x00007FF7825E0000-0x00007FF782931000-memory.dmp

Filesize
3.3MB

Download
memory/6392-2206-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/6392-2085-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/6412-2223-0x00007FF6A5530000-0x00007FF6A5881000-memory.dmp

Filesize
3.3MB

Download
memory/6412-2179-0x00007FF6A5530000-0x00007FF6A5881000-memory.dmp

Filesize
3.3MB

Download
memory/6412-2324-0x00007FF6A5530000-0x00007FF6A5881000-memory.dmp

Filesize
3.3MB

Download
memory/6464-2220-0x00007FF6BA520000-0x00007FF6BA871000-memory.dmp

Filesize
3.3MB

Download
memory/6464-2162-0x00007FF6BA520000-0x00007FF6BA871000-memory.dmp

Filesize
3.3MB

Download
memory/6464-2320-0x00007FF6BA520000-0x00007FF6BA871000-memory.dmp

Filesize
3.3MB

Download
memory/6644-2148-0x00007FF616630000-0x00007FF616981000-memory.dmp

Filesize
3.3MB

Download
memory/6644-2298-0x00007FF616630000-0x00007FF616981000-memory.dmp

Filesize
3.3MB

Download
memory/6644-2215-0x00007FF616630000-0x00007FF616981000-memory.dmp

Filesize
3.3MB

Download
memory/6696-2140-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp

Filesize
3.3MB

Download
memory/6696-2300-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp

Filesize
3.3MB

Download
memory/6696-2214-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp

Filesize
3.3MB

Download
memory/6800-2199-0x00007FF68A000000-0x00007FF68A351000-memory.dmp

Filesize
3.3MB

Download
memory/6800-2084-0x00007FF68A000000-0x00007FF68A351000-memory.dmp

Filesize
3.3MB

Download
memory/6800-2097-0x0000012B016C0000-0x0000012B016D0000-memory.dmp

Filesize
64KB

Download
memory/6892-2111-0x00007FF71C900000-0x00007FF71CC51000-memory.dmp

Filesize
3.3MB

Download
memory/6892-2288-0x00007FF71C900000-0x00007FF71CC51000-memory.dmp

Filesize
3.3MB

Download
memory/6892-2205-0x00007FF71C900000-0x00007FF71CC51000-memory.dmp

Filesize
3.3MB

Download
memory/6940-2147-0x00007FF647CF0000-0x00007FF648041000-memory.dmp

Filesize
3.3MB

Download
memory/6940-2208-0x00007FF647CF0000-0x00007FF648041000-memory.dmp

Filesize
3.3MB

Download
memory/6940-2302-0x00007FF647CF0000-0x00007FF648041000-memory.dmp

Filesize
3.3MB

Download
memory/7072-2304-0x00007FF62D280000-0x00007FF62D5D1000-memory.dmp

Filesize
3.3MB

Download
memory/7072-2184-0x00007FF62D280000-0x00007FF62D5D1000-memory.dmp

Filesize
3.3MB

Download
memory/7120-2182-0x00007FF7ED7B0000-0x00007FF7EDB01000-memory.dmp

Filesize
3.3MB

Download
memory/7120-2322-0x00007FF7ED7B0000-0x00007FF7EDB01000-memory.dmp

Filesize
3.3MB

Download
memory/7144-2329-0x00007FF66F5D0000-0x00007FF66F921000-memory.dmp

Filesize
3.3MB

Download
memory/7144-2180-0x00007FF66F5D0000-0x00007FF66F921000-memory.dmp

Filesize
3.3MB

Download