Analysis
-
max time kernel
594s -
max time network
599s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
29-06-2024 20:58
General
-
Target
cwel.exe
-
Size
3.1MB
-
MD5
a96e646d37c712c02f2014859c2ae1b3
-
SHA1
9c2a5842a9b929e66d2b92be8907d79c4f35fedf
-
SHA256
1e2e7d27900d3e3956f582ec7f286d7fe87d943562cfe94e4a2248888e3894b8
-
SHA512
eeebf4d049cd72d2d0a732921df9c24deb3323c18a5ca6eaec7bdb7b509106498c6b8b1b7daa33d0aa3e4bb7acdabb9eac29a872c217b6521c7415963d71b4d6
-
SSDEEP
49152:Pv6I22SsaNYfdPBldt698dBcjH8UHNqRrcvJmkoGdXTHHB72eh2NT:Pv322SsaNYfdPBldt6+dBcjHjYrQ
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
pringelsy-52942.portmap.host:52942
Mutex
ed30a1b2-d1a0-4e30-a860-b77fa3f71c40
Attributes
-
encryption_key
49F9D3CAD835E70C60B54E401E356C16B3822AE8
-
install_name
Opera GX.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
OperaVPN
-
subdirectory
common Files
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 2 IoCs
-
Checks computer location settings 2 TTPs 56 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 56 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 56 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 57 IoCs
-
Suspicious use of FindShellTrayWindow 56 IoCs
-
Suspicious use of SendNotifyMessage 56 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cwel.exe"C:\Users\Admin\AppData\Local\Temp\cwel.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UpXkN653aCTy.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\odHpvVXVPx9x.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f7⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kbx5Ylyk7cx6.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f9⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r2Lg6pEHcLsw.bat" "9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f11⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5SvOERsy33f1.bat" "11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500112⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost12⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f13⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jPsE4TBGploh.bat" "13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500114⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f15⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VMsJqijOvSsV.bat" "15⤵
-
C:\Windows\system32\chcp.comchcp 6500116⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f17⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Si8Tk4k3koUy.bat" "17⤵
-
C:\Windows\system32\chcp.comchcp 6500118⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost18⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f19⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WYAsVZK99ePR.bat" "19⤵
-
C:\Windows\system32\chcp.comchcp 6500120⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost20⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f21⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NcbKH80vmdhs.bat" "21⤵
-
C:\Windows\system32\chcp.comchcp 6500122⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost22⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f23⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\t0Y4g3O9PQO0.bat" "23⤵
-
C:\Windows\system32\chcp.comchcp 6500124⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost24⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f25⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KCJLdMoNhUNi.bat" "25⤵
-
C:\Windows\system32\chcp.comchcp 6500126⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost26⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f27⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zyhKDYQDAt5J.bat" "27⤵
-
C:\Windows\system32\chcp.comchcp 6500128⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost28⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f29⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xzX2SKS1LK6m.bat" "29⤵
-
C:\Windows\system32\chcp.comchcp 6500130⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost30⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f31⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hB7ALd6vS1FG.bat" "31⤵
-
C:\Windows\system32\chcp.comchcp 6500132⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost32⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f33⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a1ZUqss8V61P.bat" "33⤵
-
C:\Windows\system32\chcp.comchcp 6500134⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost34⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f35⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0UPMl3cLsBpQ.bat" "35⤵
-
C:\Windows\system32\chcp.comchcp 6500136⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost36⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f37⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Y6ItnML88IVr.bat" "37⤵
-
C:\Windows\system32\chcp.comchcp 6500138⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost38⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f39⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\29dJN6Y4281I.bat" "39⤵
-
C:\Windows\system32\chcp.comchcp 6500140⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost40⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f41⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2fVIUT9bAXBX.bat" "41⤵
-
C:\Windows\system32\chcp.comchcp 6500142⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost42⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f43⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7HEfudORRcok.bat" "43⤵
-
C:\Windows\system32\chcp.comchcp 6500144⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost44⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f45⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u6vd55AD5SFG.bat" "45⤵
-
C:\Windows\system32\chcp.comchcp 6500146⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost46⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f47⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VllRoyQ4PhiB.bat" "47⤵
-
C:\Windows\system32\chcp.comchcp 6500148⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost48⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f49⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pH9itUSPydz7.bat" "49⤵
-
C:\Windows\system32\chcp.comchcp 6500150⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost50⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"50⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f51⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cnqNY3uRDlm4.bat" "51⤵
-
C:\Windows\system32\chcp.comchcp 6500152⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost52⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f53⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sJWg9ZRj1YOv.bat" "53⤵
-
C:\Windows\system32\chcp.comchcp 6500154⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost54⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f55⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fbfhavof3mQq.bat" "55⤵
-
C:\Windows\system32\chcp.comchcp 6500156⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost56⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f57⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jpR0SOmJdNzz.bat" "57⤵
-
C:\Windows\system32\chcp.comchcp 6500158⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost58⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"58⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f59⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RMNwJCqv0nMs.bat" "59⤵
-
C:\Windows\system32\chcp.comchcp 6500160⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost60⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f61⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oB1xbwQ51J7G.bat" "61⤵
-
C:\Windows\system32\chcp.comchcp 6500162⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost62⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f63⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FR9Mm41DzvZe.bat" "63⤵
-
C:\Windows\system32\chcp.comchcp 6500164⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost64⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"64⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f65⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OBHMxAN77Zdu.bat" "65⤵
-
C:\Windows\system32\chcp.comchcp 6500166⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost66⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"66⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f67⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3cfhYpXERjLp.bat" "67⤵
-
C:\Windows\system32\chcp.comchcp 6500168⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost68⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"68⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f69⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FentbURtSENi.bat" "69⤵
-
C:\Windows\system32\chcp.comchcp 6500170⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost70⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"70⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f71⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\slN9uY7Hdj1c.bat" "71⤵
-
C:\Windows\system32\chcp.comchcp 6500172⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost72⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"72⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f73⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AUX8V5bMfVcy.bat" "73⤵
-
C:\Windows\system32\chcp.comchcp 6500174⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost74⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"74⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f75⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4NNeygybuiBN.bat" "75⤵
-
C:\Windows\system32\chcp.comchcp 6500176⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost76⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"76⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f77⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tZLeyTL4G8sb.bat" "77⤵
-
C:\Windows\system32\chcp.comchcp 6500178⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost78⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"78⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f79⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kT5euvRQcPG6.bat" "79⤵
-
C:\Windows\system32\chcp.comchcp 6500180⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost80⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"80⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f81⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P8xvfe21NMFX.bat" "81⤵
-
C:\Windows\system32\chcp.comchcp 6500182⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost82⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"82⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f83⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nq8QCFFfJkaj.bat" "83⤵
-
C:\Windows\system32\chcp.comchcp 6500184⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost84⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"84⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f85⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\L3OLjeliwi1D.bat" "85⤵
-
C:\Windows\system32\chcp.comchcp 6500186⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost86⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"86⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f87⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xAPUvAGU3eUw.bat" "87⤵
-
C:\Windows\system32\chcp.comchcp 6500188⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost88⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"88⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f89⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\khmFmme0L4XF.bat" "89⤵
-
C:\Windows\system32\chcp.comchcp 6500190⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost90⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"90⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f91⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hCxE810j97V3.bat" "91⤵
-
C:\Windows\system32\chcp.comchcp 6500192⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost92⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"92⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f93⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\820rMvt25ajh.bat" "93⤵
-
C:\Windows\system32\chcp.comchcp 6500194⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost94⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"94⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f95⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eeYIm8kdEv5I.bat" "95⤵
-
C:\Windows\system32\chcp.comchcp 6500196⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost96⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"96⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f97⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iZia0a0HFQ8N.bat" "97⤵
-
C:\Windows\system32\chcp.comchcp 6500198⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost98⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"98⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f99⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\S0eRxBrdhKpr.bat" "99⤵
-
C:\Windows\system32\chcp.comchcp 65001100⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost100⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"100⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f101⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lPEncHSpMbHg.bat" "101⤵
-
C:\Windows\system32\chcp.comchcp 65001102⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost102⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"102⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f103⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nQX5lC5WH0WI.bat" "103⤵
-
C:\Windows\system32\chcp.comchcp 65001104⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost104⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"104⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f105⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dZ6W1139mkVl.bat" "105⤵
-
C:\Windows\system32\chcp.comchcp 65001106⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost106⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"106⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f107⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LCelXsy9CnOU.bat" "107⤵
-
C:\Windows\system32\chcp.comchcp 65001108⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost108⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"108⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f109⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PMQ45T3FCaua.bat" "109⤵
-
C:\Windows\system32\chcp.comchcp 65001110⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost110⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"110⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f111⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2DRVmPq1e3xI.bat" "111⤵
-
C:\Windows\system32\chcp.comchcp 65001112⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost112⤵
- Runs ping.exe
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"112⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f113⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cBd3bwnTUTRR.bat" "113⤵
-
C:\Windows\system32\chcp.comchcp 65001114⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost114⤵
- Runs ping.exe
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4156,i,3144109701624127473,12586215149656995128,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2316,i,3144109701624127473,12586215149656995128,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Opera GX.exeFilesize
3.1MB
MD5a96e646d37c712c02f2014859c2ae1b3
SHA19c2a5842a9b929e66d2b92be8907d79c4f35fedf
SHA2561e2e7d27900d3e3956f582ec7f286d7fe87d943562cfe94e4a2248888e3894b8
SHA512eeebf4d049cd72d2d0a732921df9c24deb3323c18a5ca6eaec7bdb7b509106498c6b8b1b7daa33d0aa3e4bb7acdabb9eac29a872c217b6521c7415963d71b4d6
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Opera GX.exe.logFilesize
2KB
MD58f0271a63446aef01cf2bfc7b7c7976b
SHA1b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA256da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
SHA51278a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
-
C:\Users\Admin\AppData\Local\Temp\0UPMl3cLsBpQ.batFilesize
201B
MD531bf4415091d5ad4912ed5da143747cd
SHA138f6abdeb317fe617e040897283f26acf4d97cc4
SHA256d6852ab862ed2fd930cde8abb30a9b6a076c2dbcec1722873fe20f95e388b399
SHA512bc4970552d332c1269404cee565c947de27bf30d6fb33a51330fa67c4b78d873169a14ad0b22c4c5a672f151d5c883941de24a4aadf2fcb4d0d16a338258fabe
-
C:\Users\Admin\AppData\Local\Temp\29dJN6Y4281I.batFilesize
201B
MD5142d440b3b21ea3b5d012a742480b8ab
SHA1ad05c47fe588e815e33a0c29b21498fd32377571
SHA256a0340ca0041ad6c327168de1ed5a3391d34ba88ee98cec06f1c46f89c7efe012
SHA512824d97761f6a65720ec8fbb9e964c732d93ecaf66818179e5e7739ed7c3f765ad5be7f91d828271b2299b80ae6e2e113b4d487f28c10a70bedad353128818e51
-
C:\Users\Admin\AppData\Local\Temp\2fVIUT9bAXBX.batFilesize
201B
MD554c13900afec8fc4111a74b6384b2a84
SHA1416d6505b83d078c02f1645caeaad0bf132ef7de
SHA25647f26a475b49fd2550abda1b47f49b03a739ce22eba31552d090c38ae9c09b03
SHA512c925e36062536783789c317f625a9957ec6918b1584fbbcea1790d88d7c4f7458ddc901ec77919bec38ed129e13c083300080431492903b38ce8deab2430d5ac
-
C:\Users\Admin\AppData\Local\Temp\5SvOERsy33f1.batFilesize
201B
MD5360f3b9224b30b80322030d5a400d9c4
SHA156b30aeb5673c81442203b21a345fd4b69ab3caa
SHA2567943f2ca9cf14ed3273b05a9852f13820bbb665a51685785caf45b65dd210c16
SHA512411f8eb0e15039782a93b1648891f44726ceee287debcbc3058778fffc144026fca2d42ea257d0214e7108ab6246a3c57890472cf3a8b90c75556bc168342dee
-
C:\Users\Admin\AppData\Local\Temp\7HEfudORRcok.batFilesize
201B
MD5c35e696ce756fb8cb5f4abf7b1a7c09b
SHA14837aa986a4e304660318ca5e35b62d2f1c342a5
SHA25632759f9b5f2f765ffd01a7bef1840d6f13a3d294a556ec0556b9b6a857a07727
SHA512ea0735736edddc8b22e8d8cbf236792142f64f6a8fbb9f64a1fe0497fb94d58f0dd8c99208e20d590368fd07d58e55d8f8d7b15cd4cdbd16f6732a44d12bef4d
-
C:\Users\Admin\AppData\Local\Temp\FR9Mm41DzvZe.batFilesize
201B
MD5186d70c7911f46ea80790e73146114d4
SHA1f3e74612f4ff70b0c4e08df0136b279707c2b585
SHA256332aa1cf81150f2091553ac26d027ffef5a26ff7ed387927518e9abb2d6b3633
SHA5124213a4675ab53cf077c04c817acb69caca88b1f41e463cd0bc62fb57e80846e1168a8bba7816400a308188c295885bc4bd3194a38e0daa40c6154a4dbb14d1de
-
C:\Users\Admin\AppData\Local\Temp\KCJLdMoNhUNi.batFilesize
201B
MD5b6751ffc583b33285b228d09625c73cd
SHA11154598df140421946e0b372a29f40b09b09af47
SHA256bfb09ee0fb36571eaaec4560962a46c6a845513322692c85cd824032ac975d9b
SHA512042ab78ee7c82762e578ad761d55ec71717aa61006f33f0c3045029dfa7270470adf13092d4f9c2f9bff0a4f27d48f328305924d8453d303dd956bf6d11d569e
-
C:\Users\Admin\AppData\Local\Temp\NcbKH80vmdhs.batFilesize
201B
MD54ac8501ebbd20a1f24deeb312e934503
SHA14a3c738a3187321dc3a007a21d44319f046fe956
SHA25687ccac6f89645a979588e060d5bb8cd5eec6d8e86b6ebf7222c9679b05deaa47
SHA512913f7f412b25e2aac991ab11aabac65b91a961c34e9cf1d3072c699c8b3e73f7338e649bfa0514d3abd6f7205c2c37dd9646be209bb729d97a9dd4d68138509b
-
C:\Users\Admin\AppData\Local\Temp\RMNwJCqv0nMs.batFilesize
201B
MD546d24de96dfb47d983362745c5026a0c
SHA1ef8d0a407151cdf9771cdf86fd22b64d2f8a140e
SHA2568cd816f113d7d03316f390d707619d6a631d00265c6e5173fdf54a717414d758
SHA512a6edf9187b5b2bcbebf353025599d91e169eed352c80fe1cf850f4cd49e7791dadcec93ea9c270798a261a666052d44ae0c296a5bde7ace0d39350bc62d12341
-
C:\Users\Admin\AppData\Local\Temp\Si8Tk4k3koUy.batFilesize
201B
MD564708b9ac0724c93bb538f77fa2e7964
SHA1a72a45d9adc4c301a22164dbcf42fcc7e68b3b5e
SHA2562d27aef7d392e4871512fe99484c2b870c37b171c3161672b6d6e04452a70d45
SHA5129fb96b7dbbfa5648b0b6be518b0d9f27862dcaf653e7401ca7eb0a291c762019ed55c5bfe5c8384bafc0d32e68b35d63e84b54761bda8c86304928d78bc185d5
-
C:\Users\Admin\AppData\Local\Temp\UpXkN653aCTy.batFilesize
201B
MD5e89a368fcb7f5b14be340b92d00c7fb4
SHA1c080dce41bb3e457bfece223f2345899c65f4994
SHA256ca93d8c829ec12072972487315ef6aca05a7a6302c72c9d24afe74bb1deac77c
SHA512afb712a56c512c3f61b7e48178c9319e85259a5c856fd115f5e94dd8dfa4a0da42b2e5f2f5a59d344051b8dcaa3e7de8007f106aba3e0e70bd1d8792042219dd
-
C:\Users\Admin\AppData\Local\Temp\VMsJqijOvSsV.batFilesize
201B
MD5cc77c026c24606380c8dbc408ec7051b
SHA1d901cd5bf24ff9ec9ae648ac170efea947e6a61a
SHA256c86a7debaf9a2e77bdbfdb91d682cadb4b3a051c7bb3f205d35634eb52ee07f3
SHA512a0dd54e436777da95d6739e3e2daec7087809617e667bd48381c0eb7e49b13fa8e1dde624a4f6602842ea009f9582bce20bc7bb66feaa309dd3771d2b3c87afd
-
C:\Users\Admin\AppData\Local\Temp\VllRoyQ4PhiB.batFilesize
201B
MD5e2315c01ef32d61a38ee976f8e944693
SHA12b6e1e3a2de88964502c38c761046aeaf38de641
SHA256b034c389bdd1b23aaefc2bbcd3997004eae95c291c899b168effa513743195ca
SHA512496b07cb7b95e378793617ef4a6480dacd56eec935c8fa32bc7f948a42a7398e82fcc9974c398a419b93c4c418e3ff54f8cb25e951d6e89c0944e03acfe2e7d7
-
C:\Users\Admin\AppData\Local\Temp\WYAsVZK99ePR.batFilesize
201B
MD55ed8bc494b3bd6dec44f4704fc2fafdd
SHA1fb5054f8dd124e3ca0bd80ef320fa3c15e02a27e
SHA2560a46e8e7f9ec0db806ccf665c9b797fe16d535f676e325800d443a63345c5257
SHA512d9531418f813f559721d6eeb38b4f6189624a25be3a1eed34179217af86b1f5c0e2b1c67b7f413238a8a05968bec9ac8ccab7ccff464eafe513e67441d579138
-
C:\Users\Admin\AppData\Local\Temp\Y6ItnML88IVr.batFilesize
201B
MD5332a3c0681651bac7b91e0ad0a2d2196
SHA1702607c8f9a4d43a265cc89049b2f9e0544e1fd9
SHA25682b3a13dd44152ddc023b66a4ec527dadc55ac6e2a9afc3a090b87bac840cb8e
SHA512970428edaca688b1fb5e9388e48c7eca62bb5ecd1cd82534c5d24989740298f4ee6eb7425bd66146dc0767bf1f26b0bc5d47f9dd6558767f3cbf117be00be247
-
C:\Users\Admin\AppData\Local\Temp\a1ZUqss8V61P.batFilesize
201B
MD593fd7952aae582ba12b72171641a2c6a
SHA1d3bff97c7b55128a9ee589da18e18e32c22f5c04
SHA256e591937d8ad53ed45652546d3a43c46b1a0ed8395bce87afe3c09005faeb373b
SHA512471bcedb192a3471e47e16450a4833199954d73f91322985fabfd59680192ca503e8158221f7a8948ad1c20620ec96ef8c6a2d2145b24269302f066be91cd58a
-
C:\Users\Admin\AppData\Local\Temp\cnqNY3uRDlm4.batFilesize
201B
MD52c769b250d56c3100d5378eedec198ef
SHA199f95dcb6f3f837884f0655e58f8ee3c52eb72cc
SHA256f4e6c10bee00198fa6f3d41f0d2b082e6ca449673d9067a54b70602897986aab
SHA5125082aacfc1e910dc712d442c89105ab801e8265e72bfa3029fbe066dfba4dede75671780b81eff92b575f1fd7bc294d82485aa3f2ff00314dea6cb48d851dbf3
-
C:\Users\Admin\AppData\Local\Temp\fbfhavof3mQq.batFilesize
201B
MD5a867a1ac6a2a21156a4fbccad642b8bc
SHA12c0f02072550130cd1d97a3f4c39e956a86baf50
SHA256fd2621e41c77fc7b7c715bb5ad1b93e3e53e66c0b7e7920819ffcb497da6ac40
SHA5125201361a306e6a961e9acb7fecc35901c3cf7b490b60004ae64fb86e6d48c45a7629e90c3ea4180c60939786ba1c8c924044eee32dabdfb05dd156a6ba66b9a3
-
C:\Users\Admin\AppData\Local\Temp\hB7ALd6vS1FG.batFilesize
201B
MD5c2da720f51082bd9fc27a4e4ba4f9f48
SHA1ad186eae7a9eb63a0603feed714fec54b6738997
SHA256c781fcce9b3298a3e105e99d11f7feb265d776a720589fbe14a8581cc690d151
SHA5125999e3ef7e98f74caf3cc74b89b9d00b9db799d8bc4bee52921c4553cf77b269d23036aca8df345533df03f58730932b09c01b9c9f281f38ca12590cdab25937
-
C:\Users\Admin\AppData\Local\Temp\jPsE4TBGploh.batFilesize
201B
MD5a31c722e8f72423a0bdbca04e65ae554
SHA155330ca15317ea2ccabece6364e9ea78e08c5c0e
SHA256e0431decabefac81b4bb3997d6231a0930501a977e8805bced67bf743741db2b
SHA51219a69f7bd59efd597915772df666f03faa94687f15b169dfc33bf98423d8216db9baacb51bb56b65d2d38061a5b8e38c91b6ef3936de959cba94c8a65a3f3b27
-
C:\Users\Admin\AppData\Local\Temp\jpR0SOmJdNzz.batFilesize
201B
MD54390cb28dc5be163bfa7fc56dd8cb9ed
SHA18f864b5b6d56956839584282aa137d1f48e88116
SHA25625357f9caec764ef22e7ca24ddac0a5b47e0d6d08fa816139e4992a39563d02b
SHA51257fc9882d2fafaa11586f7bd8e7609cd174744f3f44d8d6101fe57a30f65b9a9950468825ad42eac1b540738377eda79aecea1d1815f1f00c075fcca21128170
-
C:\Users\Admin\AppData\Local\Temp\kbx5Ylyk7cx6.batFilesize
201B
MD5360681cffc22e30c765231485024a300
SHA109cf9dceca2e25e62238fe292ac41e5a728ef494
SHA2569dd03f94ed46b8d6c78fc94134705158ca77aff272a31e30c2d20418065263c4
SHA512f248e511e6c8cd10ebac7e3d86fbb9c06dcb1bb14880a57a1ace42c7cc93e8eee6196369f0b0c986545a9e3a732b6de5263486f61090f309de7097e06a98662a
-
C:\Users\Admin\AppData\Local\Temp\oB1xbwQ51J7G.batFilesize
201B
MD501d42fc223c05a312ee9d0a94975866e
SHA1b14512e0d19721e04c09236536c4cca284358372
SHA256b35ed8f2cace1d13c61bbc5d92d3976b1b88a31e955ac032a177ed7401013b75
SHA5127e968816f6b5ac371d432c7abafb9e0229992690d534ad6d8b89de7cf6be7d840e9254bc4e0074900e6d98cde7d9d17671d7ebb791c1e937a58059d686ae8de7
-
C:\Users\Admin\AppData\Local\Temp\odHpvVXVPx9x.batFilesize
201B
MD50adaaab071dccecab6b453128e9cf0cd
SHA1681fb2e027b927aba6879c6b1b785217f42749d9
SHA256ca30d73792c370cee68196b6c710e0e042b299c5f74e06af1bcf0e30012fa90e
SHA512032fcbb70c9e8dc663413d8aec7dc6bc04230949eed03aeafc304b54db94b1f2b9827ad942751e3296b2cd5a48e432153db58d16224515fa91654d7568d65da1
-
C:\Users\Admin\AppData\Local\Temp\pH9itUSPydz7.batFilesize
201B
MD5e67e7f7d74fd76586600067b50c9c162
SHA100d03f08e6664ea337f61d3fe06a0dd190f83b33
SHA256b66c74ec9187abcce87e1cccfe0bd680705efbabd67eada3aab35980379e46ae
SHA512d182e58745b6e52328125b2d1dfb52be8d5217dc60ba1487c38ef20a33b2e0accf566a0c457c1a72cf62c16dfd3d3a8d90c3a38bd130cba84b9918b623c9dd19
-
C:\Users\Admin\AppData\Local\Temp\r2Lg6pEHcLsw.batFilesize
201B
MD5035cfcbb920156cdf05fb6e62de83194
SHA1af1104a655f2254129341aab984ad99e19cca162
SHA2564ba0f49938cf11295aa8b429aab5e96f970ea213d144336a752f4fcf21d41a95
SHA5129f5c0a620cef85162de6f33b7877bff1587d95f021772dd591280da9068b2b52baf2ad35e23f618afbfdcfa12ffc719f6ba642f87a2befef3fd8bff33a4c5d37
-
C:\Users\Admin\AppData\Local\Temp\sJWg9ZRj1YOv.batFilesize
201B
MD593f86b3a70d6984aeb2b0dcf7348071a
SHA115907bb894f07dd12bcde364998b7dfbab798226
SHA2562b6dbebb231047ca8a1ce0ee07f59e98cbcc8a37edd6da38c889a9decd6340e9
SHA5122e71f2448fc664fcdab2ff7e22fe95bb606cf55dbe962d44259be0a7577a5ec32667597769303f00b5a525041ecec157759cae3d53e176fbe411ffe4830ec25e
-
C:\Users\Admin\AppData\Local\Temp\t0Y4g3O9PQO0.batFilesize
201B
MD5c2794b0e92ceb8bdbf9caf9e6c377b37
SHA191d5bafb13a7fb635da1611e4fbdcd4489be7a6b
SHA256256dc6907bada153967910002799fa37734131b044e4f4871b246ddbd8ebd4ae
SHA512e429d5b88bea693bed231dc2034adf579471acb2e05c5ef02b02a407b51b65a7eae4971dc1ad0a44df3dedbcddb74536d96b66d01dba60ffd393c2787b5083a8
-
C:\Users\Admin\AppData\Local\Temp\u6vd55AD5SFG.batFilesize
201B
MD5c99c2817e93860771a9b311d51a79993
SHA136847287787a3d7971f1dc66a2a02c419b771212
SHA256d97b31039f5846dce8b59d2d3d6a3d572b4739c3f1ff63ac022e7a00bb7d6079
SHA51201a10c06a0b68302edb2bb6598116979d4e9995bb040aba4f7e387b2267f1556e944e48197ddbe39d5f11ca87c37fc2d0d1c17a1c08bf564095596af35f394d0
-
C:\Users\Admin\AppData\Local\Temp\xzX2SKS1LK6m.batFilesize
201B
MD53bdd4a4e7160230e67d5d27e877dcdd9
SHA1b4938230a729b197e4ad50fdfa2a38fad2ae881c
SHA2563618604d2834414c8da7f75220e98a97c2d3a0521bd139e87e278cf1f0dcaf2f
SHA51292bc5461b2924d1b7305df4e6a9d1cd9cfc6a4c3d2554a1f1eb5c70f3982959e14d6fc17ae8bc25f5eb0d77d23f9db251c88ac59028c4d7cae74e9fa65df6edd
-
C:\Users\Admin\AppData\Local\Temp\zyhKDYQDAt5J.batFilesize
201B
MD5fa975850094d30d346ae9c775c2a9499
SHA1594f2b6e7eb151d21313d1f157ae589aa124b766
SHA256d8a92b4faa05fcd2b57b4053365f8f9cccb3bff11289aaa9b4e6967338f488e9
SHA5122ed53f219f02a79406f8b6e6392b3ec139b93311fba8e152f5af6f055fe74ecc5b32d3058f1d312424d6042994ad40ddde98841c970dbee49b3c7deb7a98f240
-
memory/1060-2-0x00007FFAAC1A0000-0x00007FFAACC61000-memory.dmpFilesize
10.8MB
-
memory/1060-10-0x00007FFAAC1A0000-0x00007FFAACC61000-memory.dmpFilesize
10.8MB
-
memory/1060-0-0x00007FFAAC1A3000-0x00007FFAAC1A5000-memory.dmpFilesize
8KB
-
memory/1060-1-0x0000000000C10000-0x0000000000F34000-memory.dmpFilesize
3.1MB
-
memory/4060-9-0x00007FFAAC1A0000-0x00007FFAACC61000-memory.dmpFilesize
10.8MB
-
memory/4060-11-0x00007FFAAC1A0000-0x00007FFAACC61000-memory.dmpFilesize
10.8MB
-
memory/4060-12-0x000000001BC90000-0x000000001BCE0000-memory.dmpFilesize
320KB
-
memory/4060-18-0x00007FFAAC1A0000-0x00007FFAACC61000-memory.dmpFilesize
10.8MB
-
memory/4060-13-0x000000001BDA0000-0x000000001BE52000-memory.dmpFilesize
712KB