Analysis
-
max time kernel
128s -
max time network
302s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18-04-2024 23:04
Static task
static1
Behavioral task
behavioral1
Sample
b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe
Resource
win7-20240215-en
General
-
Target
b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe
-
Size
383KB
-
MD5
81f2e982687c695ee0bbadf147feca3b
-
SHA1
b33a15b47c3b99c65f2277562a928bf9ce9dabf7
-
SHA256
b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331
-
SHA512
16461398006e12c7acc47ae87859bc4567405a7fdca2e3d13863cf14b424036c1703d882f30a3e4aa62a2cec9d8c994b6fa823ba8250ec0e6ba35f52ae2ecf05
-
SSDEEP
6144:kz00wubhcFv7g9X7wkDStegoIG2sJnuhLvdHVpHBm/F0kpJVdVpftj7XfLT:kzhBqFv7g9kBVG2ACLvd1pBmN3pJ5plX
Malware Config
Extracted
stealc
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
-
Glupteba payload 16 IoCs
Processes:
resource yara_rule behavioral2/memory/2112-40-0x00000000050B0000-0x000000000599B000-memory.dmp family_glupteba behavioral2/memory/2112-42-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4628-55-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2112-97-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4628-102-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2112-161-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4628-174-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2112-202-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4628-226-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2112-356-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4628-376-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2112-950-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4628-953-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4628-959-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4628-962-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2112-964-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba -
Modifies firewall policy service 2 TTPs 1 IoCs
Processes:
NS6rGAGIv4P400sLxCOtLJyY.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" NS6rGAGIv4P400sLxCOtLJyY.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2908 netsh.exe 4432 netsh.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Install.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe -
Drops startup file 7 IoCs
Processes:
AddInProcess32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vOybccbU5YFO9g6Z8iv7xHLo.bat AddInProcess32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uz0EM6JdLmjwS6GdV3i8IhnH.bat AddInProcess32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\95wBa8v9ZnJAdAr5iegHQEqd.bat AddInProcess32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NN9C52fxh08dpGluflTL8uzH.bat AddInProcess32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m5YkvMEu7MG92Sx0d8N8nxbf.bat AddInProcess32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VlZNpHK5CDs8G2Glf6Awja65.bat AddInProcess32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tTslk2m0oPviAmWHrY9UswwV.bat AddInProcess32.exe -
Executes dropped EXE 22 IoCs
Processes:
e3HkPHXOGfuVQUTw1Xvp757T.exe1Y5p0DBnCJqnlXI8OmDX7JHB.exebRl4jNgMLsMxBemHk5tIPc28.exe13evA9wal9gieIRSHOIx7DVn.exeu3p4.0.exe13evA9wal9gieIRSHOIx7DVn.exePs6Oo1KnG5cl0a9XxX9mCevu.exeInstall.exe13evA9wal9gieIRSHOIx7DVn.exe13evA9wal9gieIRSHOIx7DVn.exeNS6rGAGIv4P400sLxCOtLJyY.exe13evA9wal9gieIRSHOIx7DVn.exeQg_Appv5.exeu3p4.1.exeUniversalInstaller.exeUniversalInstaller.exeAssistant_109.0.5097.45_Setup.exe_sfx.exeassistant_installer.exeassistant_installer.exebRl4jNgMLsMxBemHk5tIPc28.exe1Y5p0DBnCJqnlXI8OmDX7JHB.exeCIIqjcQ.exepid process 4792 e3HkPHXOGfuVQUTw1Xvp757T.exe 2112 1Y5p0DBnCJqnlXI8OmDX7JHB.exe 4628 bRl4jNgMLsMxBemHk5tIPc28.exe 4840 13evA9wal9gieIRSHOIx7DVn.exe 3116 u3p4.0.exe 4132 13evA9wal9gieIRSHOIx7DVn.exe 3768 Ps6Oo1KnG5cl0a9XxX9mCevu.exe 780 Install.exe 1092 13evA9wal9gieIRSHOIx7DVn.exe 1488 13evA9wal9gieIRSHOIx7DVn.exe 3968 NS6rGAGIv4P400sLxCOtLJyY.exe 1936 13evA9wal9gieIRSHOIx7DVn.exe 4136 Qg_Appv5.exe 4328 u3p4.1.exe 1324 UniversalInstaller.exe 2096 UniversalInstaller.exe 3264 Assistant_109.0.5097.45_Setup.exe_sfx.exe 4388 assistant_installer.exe 3960 assistant_installer.exe 3032 bRl4jNgMLsMxBemHk5tIPc28.exe 4312 1Y5p0DBnCJqnlXI8OmDX7JHB.exe 4500 CIIqjcQ.exe -
Loads dropped DLL 13 IoCs
Processes:
13evA9wal9gieIRSHOIx7DVn.exe13evA9wal9gieIRSHOIx7DVn.exe13evA9wal9gieIRSHOIx7DVn.exe13evA9wal9gieIRSHOIx7DVn.exe13evA9wal9gieIRSHOIx7DVn.exeUniversalInstaller.exeUniversalInstaller.exeassistant_installer.exeassistant_installer.exepid process 4840 13evA9wal9gieIRSHOIx7DVn.exe 4132 13evA9wal9gieIRSHOIx7DVn.exe 1092 13evA9wal9gieIRSHOIx7DVn.exe 1488 13evA9wal9gieIRSHOIx7DVn.exe 1936 13evA9wal9gieIRSHOIx7DVn.exe 1324 UniversalInstaller.exe 1324 UniversalInstaller.exe 2096 UniversalInstaller.exe 2096 UniversalInstaller.exe 4388 assistant_installer.exe 4388 assistant_installer.exe 3960 assistant_installer.exe 3960 assistant_installer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
13evA9wal9gieIRSHOIx7DVn.exe13evA9wal9gieIRSHOIx7DVn.exedescription ioc process File opened (read-only) \??\F: 13evA9wal9gieIRSHOIx7DVn.exe File opened (read-only) \??\D: 13evA9wal9gieIRSHOIx7DVn.exe File opened (read-only) \??\F: 13evA9wal9gieIRSHOIx7DVn.exe File opened (read-only) \??\D: 13evA9wal9gieIRSHOIx7DVn.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in System32 directory 6 IoCs
Processes:
powershell.exeNS6rGAGIv4P400sLxCOtLJyY.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\System32\GroupPolicy NS6rGAGIv4P400sLxCOtLJyY.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini NS6rGAGIv4P400sLxCOtLJyY.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol NS6rGAGIv4P400sLxCOtLJyY.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI NS6rGAGIv4P400sLxCOtLJyY.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exeUniversalInstaller.execmd.exedescription pid process target process PID 320 set thread context of 4728 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 2096 set thread context of 2200 2096 UniversalInstaller.exe cmd.exe PID 2200 set thread context of 3204 2200 cmd.exe MSBuild.exe -
Drops file in Windows directory 2 IoCs
Processes:
schtasks.execmd.exedescription ioc process File created C:\Windows\Tasks\bWycNackLSywaqkmgR.job schtasks.exe File created C:\Windows\Tasks\GS_Debug.job cmd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 5060 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
u3p4.1.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u3p4.1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u3p4.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u3p4.1.exe -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2964 schtasks.exe 4368 schtasks.exe 4508 schtasks.exe 3476 schtasks.exe 440 schtasks.exe 3640 schtasks.exe 1932 schtasks.exe 1340 schtasks.exe 2792 schtasks.exe 2984 schtasks.exe 4372 schtasks.exe 752 schtasks.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
Install.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
1Y5p0DBnCJqnlXI8OmDX7JHB.exepowershell.exepowershell.exebRl4jNgMLsMxBemHk5tIPc28.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 bRl4jNgMLsMxBemHk5tIPc28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 1Y5p0DBnCJqnlXI8OmDX7JHB.exe -
Processes:
13evA9wal9gieIRSHOIx7DVn.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e 13evA9wal9gieIRSHOIx7DVn.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e 13evA9wal9gieIRSHOIx7DVn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 13evA9wal9gieIRSHOIx7DVn.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e 13evA9wal9gieIRSHOIx7DVn.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e 13evA9wal9gieIRSHOIx7DVn.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exepowershell.exepowershell.exepowershell.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.execmd.exebRl4jNgMLsMxBemHk5tIPc28.exe1Y5p0DBnCJqnlXI8OmDX7JHB.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exepowershell.exeMSBuild.exepowershell.exepowershell.exepowershell.exepid process 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe 4440 powershell.exe 4440 powershell.exe 4440 powershell.exe 4440 powershell.exe 4576 powershell.exe 4576 powershell.exe 228 powershell.exe 228 powershell.exe 4576 powershell.exe 228 powershell.exe 4576 powershell.exe 228 powershell.exe 4136 Qg_Appv5.exe 4136 Qg_Appv5.exe 4136 Qg_Appv5.exe 4136 Qg_Appv5.exe 4136 Qg_Appv5.exe 1324 UniversalInstaller.exe 2096 UniversalInstaller.exe 2096 UniversalInstaller.exe 2096 UniversalInstaller.exe 2200 cmd.exe 2200 cmd.exe 2200 cmd.exe 2200 cmd.exe 4628 bRl4jNgMLsMxBemHk5tIPc28.exe 4628 bRl4jNgMLsMxBemHk5tIPc28.exe 2112 1Y5p0DBnCJqnlXI8OmDX7JHB.exe 2112 1Y5p0DBnCJqnlXI8OmDX7JHB.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3060 powershell.exe 3060 powershell.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3060 powershell.exe 3060 powershell.exe 3204 MSBuild.exe 3204 MSBuild.exe 5100 powershell.exe 5100 powershell.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 5100 powershell.exe 4380 powershell.exe 4380 powershell.exe 4380 powershell.exe 5100 powershell.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 4380 powershell.exe 3856 powershell.exe 3856 powershell.exe 3856 powershell.exe 3856 powershell.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
UniversalInstaller.execmd.exepid process 2096 UniversalInstaller.exe 2200 cmd.exe 2200 cmd.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
Processes:
b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exeAddInProcess32.exepowershell.exepowershell.exepowershell.exeWMIC.exebRl4jNgMLsMxBemHk5tIPc28.exe1Y5p0DBnCJqnlXI8OmDX7JHB.exeMSBuild.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe Token: SeDebugPrivilege 4728 AddInProcess32.exe Token: SeDebugPrivilege 4440 powershell.exe Token: SeDebugPrivilege 4576 powershell.exe Token: SeDebugPrivilege 228 powershell.exe Token: SeIncreaseQuotaPrivilege 2144 WMIC.exe Token: SeSecurityPrivilege 2144 WMIC.exe Token: SeTakeOwnershipPrivilege 2144 WMIC.exe Token: SeLoadDriverPrivilege 2144 WMIC.exe Token: SeSystemProfilePrivilege 2144 WMIC.exe Token: SeSystemtimePrivilege 2144 WMIC.exe Token: SeProfSingleProcessPrivilege 2144 WMIC.exe Token: SeIncBasePriorityPrivilege 2144 WMIC.exe Token: SeCreatePagefilePrivilege 2144 WMIC.exe Token: SeBackupPrivilege 2144 WMIC.exe Token: SeRestorePrivilege 2144 WMIC.exe Token: SeShutdownPrivilege 2144 WMIC.exe Token: SeDebugPrivilege 2144 WMIC.exe Token: SeSystemEnvironmentPrivilege 2144 WMIC.exe Token: SeRemoteShutdownPrivilege 2144 WMIC.exe Token: SeUndockPrivilege 2144 WMIC.exe Token: SeManageVolumePrivilege 2144 WMIC.exe Token: 33 2144 WMIC.exe Token: 34 2144 WMIC.exe Token: 35 2144 WMIC.exe Token: 36 2144 WMIC.exe Token: SeIncreaseQuotaPrivilege 2144 WMIC.exe Token: SeSecurityPrivilege 2144 WMIC.exe Token: SeTakeOwnershipPrivilege 2144 WMIC.exe Token: SeLoadDriverPrivilege 2144 WMIC.exe Token: SeSystemProfilePrivilege 2144 WMIC.exe Token: SeSystemtimePrivilege 2144 WMIC.exe Token: SeProfSingleProcessPrivilege 2144 WMIC.exe Token: SeIncBasePriorityPrivilege 2144 WMIC.exe Token: SeCreatePagefilePrivilege 2144 WMIC.exe Token: SeBackupPrivilege 2144 WMIC.exe Token: SeRestorePrivilege 2144 WMIC.exe Token: SeShutdownPrivilege 2144 WMIC.exe Token: SeDebugPrivilege 2144 WMIC.exe Token: SeSystemEnvironmentPrivilege 2144 WMIC.exe Token: SeRemoteShutdownPrivilege 2144 WMIC.exe Token: SeUndockPrivilege 2144 WMIC.exe Token: SeManageVolumePrivilege 2144 WMIC.exe Token: 33 2144 WMIC.exe Token: 34 2144 WMIC.exe Token: 35 2144 WMIC.exe Token: 36 2144 WMIC.exe Token: SeDebugPrivilege 4628 bRl4jNgMLsMxBemHk5tIPc28.exe Token: SeImpersonatePrivilege 4628 bRl4jNgMLsMxBemHk5tIPc28.exe Token: SeDebugPrivilege 2112 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Token: SeImpersonatePrivilege 2112 1Y5p0DBnCJqnlXI8OmDX7JHB.exe Token: SeDebugPrivilege 3204 MSBuild.exe Token: SeDebugPrivilege 632 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Token: SeDebugPrivilege 3060 powershell.exe Token: SeDebugPrivilege 5100 powershell.exe Token: SeDebugPrivilege 4380 powershell.exe Token: SeDebugPrivilege 3856 powershell.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
u3p4.1.exepid process 4328 u3p4.1.exe 4328 u3p4.1.exe 4328 u3p4.1.exe 4328 u3p4.1.exe 4328 u3p4.1.exe 4328 u3p4.1.exe 4328 u3p4.1.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
u3p4.1.exepid process 4328 u3p4.1.exe 4328 u3p4.1.exe 4328 u3p4.1.exe 4328 u3p4.1.exe 4328 u3p4.1.exe 4328 u3p4.1.exe 4328 u3p4.1.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exeMSBuild.exepid process 4136 Qg_Appv5.exe 1324 UniversalInstaller.exe 1324 UniversalInstaller.exe 2096 UniversalInstaller.exe 2096 UniversalInstaller.exe 3204 MSBuild.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exeAddInProcess32.exee3HkPHXOGfuVQUTw1Xvp757T.exe13evA9wal9gieIRSHOIx7DVn.exePs6Oo1KnG5cl0a9XxX9mCevu.exe13evA9wal9gieIRSHOIx7DVn.exeInstall.exeforfiles.execmd.exebRl4jNgMLsMxBemHk5tIPc28.exedescription pid process target process PID 320 wrote to memory of 4572 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe regasm.exe PID 320 wrote to memory of 4572 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe regasm.exe PID 320 wrote to memory of 4572 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe regasm.exe PID 320 wrote to memory of 4728 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 320 wrote to memory of 4728 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 320 wrote to memory of 4728 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 320 wrote to memory of 4728 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 320 wrote to memory of 4728 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 320 wrote to memory of 4728 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 320 wrote to memory of 4728 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 320 wrote to memory of 4728 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 320 wrote to memory of 4620 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 320 wrote to memory of 4620 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 320 wrote to memory of 4620 320 b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe AddInProcess32.exe PID 4728 wrote to memory of 4792 4728 AddInProcess32.exe e3HkPHXOGfuVQUTw1Xvp757T.exe PID 4728 wrote to memory of 4792 4728 AddInProcess32.exe e3HkPHXOGfuVQUTw1Xvp757T.exe PID 4728 wrote to memory of 4792 4728 AddInProcess32.exe e3HkPHXOGfuVQUTw1Xvp757T.exe PID 4728 wrote to memory of 2112 4728 AddInProcess32.exe svchost.exe PID 4728 wrote to memory of 2112 4728 AddInProcess32.exe svchost.exe PID 4728 wrote to memory of 2112 4728 AddInProcess32.exe svchost.exe PID 4728 wrote to memory of 4628 4728 AddInProcess32.exe Conhost.exe PID 4728 wrote to memory of 4628 4728 AddInProcess32.exe Conhost.exe PID 4728 wrote to memory of 4628 4728 AddInProcess32.exe Conhost.exe PID 4792 wrote to memory of 3116 4792 e3HkPHXOGfuVQUTw1Xvp757T.exe u3p4.0.exe PID 4792 wrote to memory of 3116 4792 e3HkPHXOGfuVQUTw1Xvp757T.exe u3p4.0.exe PID 4792 wrote to memory of 3116 4792 e3HkPHXOGfuVQUTw1Xvp757T.exe u3p4.0.exe PID 4728 wrote to memory of 4840 4728 AddInProcess32.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 4728 wrote to memory of 4840 4728 AddInProcess32.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 4728 wrote to memory of 4840 4728 AddInProcess32.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 4840 wrote to memory of 4132 4840 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 4840 wrote to memory of 4132 4840 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 4840 wrote to memory of 4132 4840 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 4728 wrote to memory of 3768 4728 AddInProcess32.exe Ps6Oo1KnG5cl0a9XxX9mCevu.exe PID 4728 wrote to memory of 3768 4728 AddInProcess32.exe Ps6Oo1KnG5cl0a9XxX9mCevu.exe PID 4728 wrote to memory of 3768 4728 AddInProcess32.exe Ps6Oo1KnG5cl0a9XxX9mCevu.exe PID 3768 wrote to memory of 780 3768 Ps6Oo1KnG5cl0a9XxX9mCevu.exe Install.exe PID 3768 wrote to memory of 780 3768 Ps6Oo1KnG5cl0a9XxX9mCevu.exe Install.exe PID 3768 wrote to memory of 780 3768 Ps6Oo1KnG5cl0a9XxX9mCevu.exe Install.exe PID 4840 wrote to memory of 1092 4840 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 4840 wrote to memory of 1092 4840 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 4840 wrote to memory of 1092 4840 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 4728 wrote to memory of 3968 4728 AddInProcess32.exe NS6rGAGIv4P400sLxCOtLJyY.exe PID 4728 wrote to memory of 3968 4728 AddInProcess32.exe NS6rGAGIv4P400sLxCOtLJyY.exe PID 4840 wrote to memory of 1488 4840 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 4840 wrote to memory of 1488 4840 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 4840 wrote to memory of 1488 4840 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 1488 wrote to memory of 1936 1488 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 1488 wrote to memory of 1936 1488 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 1488 wrote to memory of 1936 1488 13evA9wal9gieIRSHOIx7DVn.exe 13evA9wal9gieIRSHOIx7DVn.exe PID 780 wrote to memory of 4224 780 Install.exe forfiles.exe PID 780 wrote to memory of 4224 780 Install.exe forfiles.exe PID 780 wrote to memory of 4224 780 Install.exe forfiles.exe PID 4224 wrote to memory of 3960 4224 forfiles.exe assistant_installer.exe PID 4224 wrote to memory of 3960 4224 forfiles.exe assistant_installer.exe PID 4224 wrote to memory of 3960 4224 forfiles.exe assistant_installer.exe PID 3960 wrote to memory of 4440 3960 cmd.exe powershell.exe PID 3960 wrote to memory of 4440 3960 cmd.exe powershell.exe PID 3960 wrote to memory of 4440 3960 cmd.exe powershell.exe PID 780 wrote to memory of 2964 780 Install.exe schtasks.exe PID 780 wrote to memory of 2964 780 Install.exe schtasks.exe PID 780 wrote to memory of 2964 780 Install.exe schtasks.exe PID 4628 wrote to memory of 4576 4628 bRl4jNgMLsMxBemHk5tIPc28.exe powershell.exe PID 4628 wrote to memory of 4576 4628 bRl4jNgMLsMxBemHk5tIPc28.exe powershell.exe PID 4628 wrote to memory of 4576 4628 bRl4jNgMLsMxBemHk5tIPc28.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe"C:\Users\Admin\AppData\Local\Temp\b1bf0f6717341cb605ebf48e85805282b77e5a3d610f211b90e4ec726b448331.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\e3HkPHXOGfuVQUTw1Xvp757T.exe"C:\Users\Admin\Pictures\e3HkPHXOGfuVQUTw1Xvp757T.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u3p4.0.exe"C:\Users\Admin\AppData\Local\Temp\u3p4.0.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exeC:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exeC:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\u3p4.1.exe"C:\Users\Admin\AppData\Local\Temp\u3p4.1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\1Y5p0DBnCJqnlXI8OmDX7JHB.exe"C:\Users\Admin\Pictures\1Y5p0DBnCJqnlXI8OmDX7JHB.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\1Y5p0DBnCJqnlXI8OmDX7JHB.exe"C:\Users\Admin\Pictures\1Y5p0DBnCJqnlXI8OmDX7JHB.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
C:\Users\Admin\Pictures\bRl4jNgMLsMxBemHk5tIPc28.exe"C:\Users\Admin\Pictures\bRl4jNgMLsMxBemHk5tIPc28.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\bRl4jNgMLsMxBemHk5tIPc28.exe"C:\Users\Admin\Pictures\bRl4jNgMLsMxBemHk5tIPc28.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe"C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe" --silent --allusers=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exeC:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x6ee0e1d0,0x6ee0e1dc,0x6ee0e1e84⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\13evA9wal9gieIRSHOIx7DVn.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\13evA9wal9gieIRSHOIx7DVn.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe"C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4840 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240418230446" --session-guid=a863f3da-9d8b-4580-ac22-12821abc3d33 --server-tracking-blob="ZGIwYzA1NzFiZTQ1MDc2ODU1MzY4MmZlYWExNGQ1NDZkZDM3MTNiOTQ1OGUzNDVkZGY5ZjMyNjlmYmY1ZWFmYzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fMTIzIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzNDgxNDc0LjMwMDUiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzEyMyIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiYmI0NTUyYjItNDg3NC00ZDdkLWEzM2UtZDVmN2E5ZDIzNGY2In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=A8040000000000004⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exeC:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2ac,0x2b0,0x2b4,0x27c,0x2b8,0x6de0e1d0,0x6de0e1dc,0x6de0e1e85⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\assistant_installer.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0xf66038,0xf66044,0xf660505⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Pictures\Ps6Oo1KnG5cl0a9XxX9mCevu.exe"C:\Users\Admin\Pictures\Ps6Oo1KnG5cl0a9XxX9mCevu.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSEA7F.tmp\Install.exe.\Install.exe /sQwdidHh "385118" /S4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 23:06:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\CIIqjcQ.exe\" em /Oxsite_idsMJ 385118 /S" /V1 /F5⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\NS6rGAGIv4P400sLxCOtLJyY.exe"C:\Users\Admin\Pictures\NS6rGAGIv4P400sLxCOtLJyY.exe"3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Users\Admin\Pictures\YSnN50VmgnYtv0QvhS8rLDMo.exe"C:\Users\Admin\Pictures\YSnN50VmgnYtv0QvhS8rLDMo.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe4⤵
-
C:\Windows\SYSTEM32\msiexec.exe"msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe"ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"5⤵
-
C:\Windows\SYSTEM32\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Windows\Downloaded Installations\{97657C9B-F62F-4B80-92E3-C146A666778F}\Charity Engine.msi" /qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\IXP000.TMP" SETUPEXENAME="ce_7.14.2_windows_x86_64.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\CIIqjcQ.exeC:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\CIIqjcQ.exe em /Oxsite_idsMJ 385118 /S1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gIzeOJPZE" /SC once /ST 01:15:47 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gIzeOJPZE"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gIzeOJPZE"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 11:38:20 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\COawlBb.exe\" XT /Alsite_iduZA 385118 /S" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "BAnwxolbGpCzXNxkj"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k smphost1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\COawlBb.exeC:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\COawlBb.exe XT /Alsite_iduZA 385118 /S1⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bWycNackLSywaqkmgR"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\crKjuS.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\qBmHapn.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "qbSDwEgyNYPZlGA"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\szVsifB.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\tGQAgve.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\Fsjebtp.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\UDjDeTD.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "QhciBzJOokLnyYZub" /SC once /ST 06:56:00 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ofqvFcNvzeRditbz\qoxRxkbs\zwzoGPj.dll\",#1 /LEsite_idHjj 385118" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "QhciBzJOokLnyYZub"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"2⤵
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\qoxRxkbs\zwzoGPj.dll",#1 /LEsite_idHjj 3851181⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\qoxRxkbs\zwzoGPj.dll",#1 /LEsite_idHjj 3851182⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "QhciBzJOokLnyYZub"3⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6307E51B5E56DA49A5E1FE177CCB8C1D2⤵
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 483ACBCEAC3F9B319689EF926D4353DE E Global\MSI00002⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BDD6BFD7B7D1C19EBDEC28EE4211E273 M Global\MSI00002⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a92055 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Modify Registry
2Impair Defenses
1Disable or Modify System Firewall
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e5b7cb1.rbsFilesize
894KB
MD53f1445cd334a481f121747ac632a7a0c
SHA16fa852d01f6c2f8089b5886efa04ea5f809b1a1d
SHA256aaa306340bf61550afed77fead65b0da212c554cfd33b6bd667d7b0cc0f8cb33
SHA512c9c911eb9b6ba7231bf706ccc44ac96474194e80caf93bcadf7c36b24f059c515c92dbc3d0b44111b69c0013abdb6dc77e647333f8fad777072d7db69ea63fd8
-
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpiFilesize
2.0MB
MD5822c4f6806d42774442e36906b028892
SHA1ccef81d21aca46a963f725636e83f5511018979c
SHA256036aff66ac516fb102bf6e334817eb6af28f3411806d2324b93a0238527ada79
SHA512c5ce2e317c1952e7e0b2c1d9326ed0ac3fe4a76f33bde57ab7492085eb32a93eaf747cc6bdcc4c404484b0459fd49ffc833a2aad537dfadcd6f8f4e1f5feed58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.jsonFilesize
187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.jsonFilesize
136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.jsonFilesize
150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
10KB
MD55f41489a291d6cd78ada563e93f490e5
SHA188e4d50abdfa8ff1bcdcfa4a4956a510f19dd8be
SHA2567e9ea0f6b50a52acabe7728ac2afa816831db013ac4fe5c7ca40c8abe5f3bf2a
SHA512f32ffb3b41080ee7f3344a0b52dabb59a008e0401c92a1b9ed3c0490d378d3c3934027a48e3fe4b9e6822aeb0e5fab01dbc46a07c45d3806e06cc74ef1e50f51
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
26KB
MD58a97fa8294afa4b64ec7841cb72ff832
SHA19084612bd931f379f527d5f42eb3c921c91205a6
SHA256e044eec1df223b698014320a6486d01a72731452ef18cc5b44d1da6718cf258f
SHA5127a2c3c57c4e91cde1d235d496aa8be01b1ec3b96ea2f4e11e9513f0b849e38ffc9dff82c457e5dcbb014115047a2f733c52df91a6e4e9fc1e014d7f284e32937
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD5e8d18d7e22c42d18a1f6936abc4f1e60
SHA193c687f2262749d2d034ff2eca8bc5e16572e399
SHA25684f0c3dcb3e1e9e89709ccd9e2cea0650d853d5d614261efe86b936ce32ef89d
SHA512defd96160752db39593eefe1931555e77406ae7bb8d5d87d0355f59b9772763cc94534cbea9e9e2cb58a6632232980e0202651cc5d1e22d1276bc830734d4cc8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
40KB
MD517fd0e1abc1e727fd5bff10b61d8ee5a
SHA142295ea1f99b091d33f9a46dc3f28266b712293b
SHA2564d11d8b16a8bb9edca8a7e73c93b335c5d68182fc16fea58b1b1328963ca87ae
SHA512753676438773d906a81145a2f633b99d3a1cd7fae54160588d7c0bf36e9e2b5c40f53a55e6a7fbd43c1bd75948c9eebebfdd6e04e61df459a50dae03c3ea049a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD586abe0d49776cac99c5941ca3795aa56
SHA1b45ab26962c14d20c7baa00b28d81eed6b2bf997
SHA256cc2823cd841e6357854144ab52ce60234094a90f701164b57a2938d493fd633c
SHA512b9add62eb44ff7b14d1dc19d4dd422dd022f57c46b97a295e30bb0a78a9f1905e333febb98061daec2f6ca17a50f18354a0f5a945debae22f64d883cc83b759a
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exeFilesize
2.5MB
MD515d8c8f36cef095a67d156969ecdb896
SHA1a1435deb5866cd341c09e56b65cdda33620fcc95
SHA2561521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8
SHA512d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\assistant_installer.exeFilesize
1.9MB
MD5976bc8e5fe65f9bb56831e20f1747150
SHA1f9e7f5628aaaabed9939ef055540e24590a9ccfb
SHA256f53c916ccf3d24d6793227283de2db0f6cc98a2275413851807cc080643d21a0
SHA5122858e7e08418b170b21b599afb02236d0480d35a5605de142f10976489e01daf2ad80df0f09c2eb38bc5a971336d1f6aa9909c520bcdb18e9c9a8e903379dcd9
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\opera_packageFilesize
103.8MB
MD55014156e9ffbb75d1a8d5fc09fabdc42
SHA16968d1b5cec3039e53bbbedeee22e2d43d94c771
SHA2567a01e11e1830ba3c154e5a6c383da15938b1e48f89a2fe4045cdd260924b6802
SHA512bfc5c44881d0fa7bcbccfd530d874fa624adec50e1a16063a72de12876d2db10ca5edd6fa841ea63e9deca3ff2adf54065f50719fe051d41de92bb68edba4016
-
C:\Users\Admin\AppData\Local\Temp\43c7232fFilesize
5.9MB
MD5dcc26dd014bad9eafa9066d3781b615d
SHA1b0cb8621ca58a196ac73bed4e525deacfaf2d836
SHA25669502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3
SHA5125a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3
-
C:\Users\Admin\AppData\Local\Temp\45d8f8b3Filesize
1.4MB
MD5f18abe3b42f4bfa604a34ab14c1a1656
SHA125cdad5636cdf60346d47d03909dc8dc6eca023a
SHA2561f21217ef59bbb61fb51b6987f4992daaa37d3b141ec5f54aa0fa37f6db24681
SHA512bce496fbc8ede8d7ebfcc74d5acbdaa3b1c4af2f9341d6b660cc0b0702932b3051ad5ea5cbeb1834173450497185a52f3f1f136b172e5ebe9394c013fabedf63
-
C:\Users\Admin\AppData\Local\Temp\7zSEA7F.tmp\Install.exeFilesize
6.8MB
MD5e77964e011d8880eae95422769249ca4
SHA18e15d7c4b7812a1da6c91738c7178adf0ff3200f
SHA256f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50
SHA5128feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exeFilesize
14.7MB
MD56955715b6ff15bdc153a2431cc395cca
SHA1272e1eec66a1871b300484b2200b507a4abe5420
SHA256a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761
SHA512cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dllFilesize
1.6MB
MD58f75e17a8bf3de6e22e77b5586f8a869
SHA1e0bf196cfc19a8772e003b9058bdc211b419b261
SHA2565f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985
SHA5125a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exeFilesize
2.4MB
MD59fb4770ced09aae3b437c1c6eb6d7334
SHA1fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA256a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
SHA512140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\somebody.rtfFilesize
24KB
MD5ff36ebcf134c8846aea77446867e5bc6
SHA153fdf2c0bec711e377edb4f97cd147728fb568f6
SHA256e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9
SHA512b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\spawn.xmlFilesize
1.3MB
MD52d8de35aa00138b2bfc4fb0fc3d0f58b
SHA128c2d84e01815702c230da456aaa17c7d2519186
SHA25619340e9202db71d8010563c8b8d325cbef5d8448a8df2ad730e74a5a46e36dac
SHA512378116bc71de9f968aaef6ca27944e341a9a825a92831f5834c396160581f5e3656d3b6d1c2a304a65a74c0dd9ca0c50fb0e0016b6174d1fab68909ea1c95128
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hadreuxb.eae.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\_isF8B9.tmpFilesize
1KB
MD59bcd3291daba5a496ef2d8b5bd084641
SHA12d21278f834244edd85ffdd14b70beed842d253b
SHA25668d3b84ffdb232331de3571ca1adfcef53a0b921cba6fe1e6960eb7144b2b639
SHA512d8375d3d0ebec313824dacb0b2214dc0a9ed8edbca095fd219f07bc960707c1e6b53d46ad8d7951a6c2c769179bd58a4c50a8d5f266d992b4507917bfc1a7f49
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD550a1008b73dede070a47e9dcd62e8484
SHA1a67614696adc3c7f6d83108f1ef0196d91c7ef66
SHA256bd9285601f32c3f71aef525052c0312db6076f4299804e92a948d6e981fdcc12
SHA512c3c5dfbb1a35ac5d4fd3c0f73dde7365b19670cb3f9330f7c815ee10840163af162af002667d95ab3ca09c2eae58d766b5fc7264bc4f1265c479b1cd0471b291
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
3KB
MD541675a76c9aa14838ab579158e6b4190
SHA1b0660b9f06f1361317961ecc1a9b324562d9dbec
SHA2564119c3088080fa30d2d80bb769a5e8d8eaa8a90f1171f6d812ae1b7d55cc855a
SHA5120d96359209881287a74ba7a14865d40c404b09b09cc3b7f8eb6816b71a758fb1696a1a69d1b7858a18c6eb991ae1fbbf0264921ea74a3616951edebd6adcff0f
-
C:\Users\Admin\AppData\Local\Temp\tmp5387.tmpFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Local\Temp\u3p4.0.exeFilesize
306KB
MD59e7bd4e6b0220bbb8c4068a02939e692
SHA192b8c83e84d6823bf4cf5238f368c27e5243241d
SHA256a547ce72c56e28616970d53b15e05cf4532a20384cae7a72b8428789a48028ef
SHA5127c1a0dcdcbeb988679ad24cbef85bd0b3f6c6c41c8699d506be3a1d6b0542fff0f6ec85eb53fe98278f787cd108771e2d168e2a9080327706edc629c41f57522
-
C:\Users\Admin\AppData\Local\Temp\u3p4.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Local\Temp\{C02ADE96-E131-4321-8E4F-C0B645211117}\0x0409.iniFilesize
21KB
MD5be345d0260ae12c5f2f337b17e07c217
SHA10976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA256e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
SHA51277040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
-
C:\Users\Admin\AppData\Local\Temp\{C02ADE96-E131-4321-8E4F-C0B645211117}\_ISMSIDEL.INIFilesize
20B
MD5db9af7503f195df96593ac42d5519075
SHA11b487531bad10f77750b8a50aca48593379e5f56
SHA2560a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
SHA5126839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
-
C:\Users\Admin\AppData\Local\Temp\~F887.tmpFilesize
5KB
MD5b2403c034d0c2c07070ba6b062c48533
SHA193e3c85774ec538076dbb8a3861a7b5528e51b43
SHA2564a2d804078cc2018e07ce42591cc5fbf0885208fcbf936083251335cb60d27a4
SHA512a268a5a4e49c60b6c8ca2052f8f1915aff84d48b1fbb96f744848abbf75c109a730b1a77541c48fc31c201ac431055bcd7ae3477ba03adb40d69aa5e01c0d0fa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs.jsFilesize
6KB
MD57df2e7659c712077d8ff46b7da5f217a
SHA1043ae744d0f7135507136711ef4ae16cedbeca9c
SHA256978f8445b44383cb074b085b099cd4d74736d3e54924bb0546b4fa6952d26e45
SHA51260987dd21cff79f6d7890da6390747471e617482d1037b3ea5630f5eafb0e93c2ae84c3b2fa8c81a897b2e128790c4ca79a98d747e8df21ef1b6b49e55752d32
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.datFilesize
40B
MD51292646a975f8109a854503e1039b2e0
SHA123f245ec50cd991f1aadf3881ae20633683eddff
SHA256757d76752ca05c5e4e959dd1418689185824396cc0bb9ccbdf940b63aaf69a0d
SHA51255d0868d8d9ccdd3d568150b4d8645bf4c96efedf2f20a83981f39252c6d50ea74791c4a8264d5562ddb8c9f239f228f8601381888a17ff11777f86d530e6846
-
C:\Users\Admin\Pictures\13evA9wal9gieIRSHOIx7DVn.exeFilesize
5.1MB
MD5cba190a5f4f106b28e58c9606f2367a2
SHA13e4d74903a9478d027eff648445a9c73195ded7c
SHA25699d81c5f9273c16cfdf4625742e7159026918a58173cf1c1d609a9498707533b
SHA5121a5b86639314d62564fa27e906fd51e63857dc650b48e4804f3b6c40fab5806fad9a43f1ae55c742c48291fd313a938a31982b407061121bdbaf47aef0905439
-
C:\Users\Admin\Pictures\1Y5p0DBnCJqnlXI8OmDX7JHB.exeFilesize
4.2MB
MD51842fc317e5a1d69802a698ae55c38f2
SHA1151e6beea179734ac936b9a09553694497ac25b5
SHA2563a28b148d121751482a29d954aeed15f8ae208f86cd3ed6b819c5c5c842e0cf9
SHA512c625d83b286c3e704f43ec80a4fed5c91bba6929c1c89e23bdc642d8778ea063507b578a7ef74368c815f4baf03fc1a8edfb4b3d9449619c3651a8cf33b139c2
-
C:\Users\Admin\Pictures\9OMbbFGAFnTpy6MrE80DSIj7.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\Pictures\NS6rGAGIv4P400sLxCOtLJyY.exeFilesize
4.9MB
MD5a25cdf843e60f609b970ac9414170a7a
SHA19d0fee8c64c58d674d383654a4391b8e41d994dc
SHA256109a993670756619db430191f217236914602b1aac6fe093e1b8b1887cc3d9f9
SHA512e4dc2979919c8ecfb2a09fd78446db57483e74ff2e3ddcb498d0718590ef0e9021424d6656822921d41b648a36253e9275045b2e4931f94f00c474b73444c6fd
-
C:\Users\Admin\Pictures\Ps6Oo1KnG5cl0a9XxX9mCevu.exeFilesize
6.5MB
MD55d5da0738299d8893b79a6c926765e5f
SHA1b05c2cfd30ca1c163cb829b7e7e5ea2d6c57d1d1
SHA25653c80bee05d28fe65ab0ae6459753fe7b804c0b68b85faaf828576687ef28ca3
SHA512d9fffe943131e71762f5e2e1ad3d23053069f0f028054be9ec2c8491a6812adadacbf099ab8fa79ca9916ceda14ccaedfe4a0e1e5235871a97145ef77d7b0b26
-
C:\Users\Admin\Pictures\e3HkPHXOGfuVQUTw1Xvp757T.exeFilesize
412KB
MD5a0f33065c51ae7e12b70b949d1e2a34b
SHA1db4c8995a4219b0c4928dcdda0fccf17918b521c
SHA256a77861e9fd8a0c3d2539d4dc325b4fd24c1dcede704dbea17f927acd58ad716d
SHA512138e4c887f14e6b98c58cbc1bc6f40222d9c66eaac6596326c5784942c60619c90343efc122bfaf095be84005e1af693a1e6a68e491408d27aba9a89eefa8563
-
C:\Windows\Downloaded Installations\{97657C9B-F62F-4B80-92E3-C146A666778F}\Charity Engine.msiFilesize
9.8MB
MD5cbe108ce6937195b2c099dcc66263f3e
SHA10c317ad78069d6d20534d45162e5164f193bbd72
SHA25662004d99aef328d0cd276b752fb6d6cf4a2db9c3cd6d11ae8ec4bf81b72ab1a2
SHA512d4685c4a63aded1f594d9e9014095161d61822893f3a589a7943f43c2c196be645772bc5a4e6b7dd579c72ad036c2e557e65cdccd42d62c855736f97bec8e7de
-
C:\Windows\Installer\MSIF1E4.tmpFilesize
195KB
MD54298cfa3dab9867af517722fe69b1333
SHA1ab4809f8c9282e599aa64a8ca9900b09b98e0425
SHA256cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8
SHA51237b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b
-
C:\Windows\Installer\e5b7cb2.msiFilesize
80.8MB
MD546d4ea1549a4b1f00893850e771d4856
SHA13935e12304c02e13b1c9e2d967294432c52eb6c4
SHA2563143e647228884858af173dfbf7ccf319f63d394b2111dc402708aa9b63f7f04
SHA512b96931eacfc0a93b90cb7df0adaf9c9f2ab806e5cbfd550023796ddd3590579c38161031f21a72e804d214b1dd4d56d5e417c1fade971c735b519565a4cf8ae5
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
C:\Windows\System32\drivers\SETCC36.tmpFilesize
1013KB
MD5321ccdb9223b0801846b9ad131ac4d81
SHA1ac8fb0fc82a8c30b57962fe5d869fda534053404
SHA25605045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b
SHA51275b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\dbgcore.dllFilesize
166KB
MD59ebb919b96f6f94e1be4cdc6913ef629
SHA131e99ac4fba516f82b36bd81784e8d518b32f9df
SHA256fdae21127deb16eb8ba36f2493d2255f4cb8ab4c18e8bd8ba5e587f5a7ecd119
SHA512a1b42f7d2896da270bb3c80cf9b88c4b4f1491084e7aa7760eeea5533b26f041dc79b21d5ffd2bba2221fe118e0a8d912e170f24fd895c9315b1ee9c7adfe700
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404182304461\assistant\dbghelp.dllFilesize
1.7MB
MD5544255258f9d45b4608ccfd27a4ed1dd
SHA1571e30ceb9c977817b5bbac306366ae59f773497
SHA2563b02fc85602e83059f611c658e3cad6bc59c3c51214d4fe7e31f3ac31388dd68
SHA5122093da881fa90eec2b90d1ca6eaaff608fe16ac612571a7fd5ed94dd5f7ff7e5c1e8c862bab0a228850829527886473e3942abd23a81d10cab8f9baad2cc7664
-
\Users\Admin\AppData\Local\Temp\Opera_installer_2404182304393874840.dllFilesize
4.6MB
MD50415cb7be0361a74a039d5f31e72fa65
SHA146ae154436c8c059ee75cbc6a18ccda96bb2021d
SHA256bb38a8806705980ee3e9181c099e8d5c425e6c9505a88e5af538ca6a48951798
SHA512f71c2b9e1559aa4eb2d72f852ef9807c781d4a7b96b8e0c2c53b895885319146bd43aa6e4223d43159f3d40bc60704206404dc034500e47fca0a94e53b60239e
-
\Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dllFilesize
1.5MB
MD57d2f87123e63950159fb2c724e55bdab
SHA1360f304a6311080e1fead8591cb4659a8d135f2d
SHA256b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a
SHA5126cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08
-
memory/228-338-0x000000007F3E0000-0x000000007F3F0000-memory.dmpFilesize
64KB
-
memory/228-339-0x000000000A7B0000-0x000000000A844000-memory.dmpFilesize
592KB
-
memory/228-773-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/228-333-0x000000000A5D0000-0x000000000A675000-memory.dmpFilesize
660KB
-
memory/228-321-0x000000006CDF0000-0x000000006D140000-memory.dmpFilesize
3.3MB
-
memory/228-323-0x000000000A550000-0x000000000A56E000-memory.dmpFilesize
120KB
-
memory/228-396-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/228-318-0x000000006CCE0000-0x000000006CD2B000-memory.dmpFilesize
300KB
-
memory/228-201-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/228-197-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/228-198-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/320-192-0x000001CC75770000-0x000001CC75780000-memory.dmpFilesize
64KB
-
memory/320-1-0x000001CC770C0000-0x000001CC7711E000-memory.dmpFilesize
376KB
-
memory/320-2-0x00007FFE18600000-0x00007FFE18FEC000-memory.dmpFilesize
9.9MB
-
memory/320-3-0x000001CC75770000-0x000001CC75780000-memory.dmpFilesize
64KB
-
memory/320-146-0x00007FFE18600000-0x00007FFE18FEC000-memory.dmpFilesize
9.9MB
-
memory/320-0-0x000001CC75340000-0x000001CC7534A000-memory.dmpFilesize
40KB
-
memory/780-658-0x00000000012C0000-0x0000000003FE5000-memory.dmpFilesize
45.1MB
-
memory/780-95-0x0000000010000000-0x0000000013BC3000-memory.dmpFilesize
59.8MB
-
memory/780-112-0x00000000012C0000-0x0000000003FE5000-memory.dmpFilesize
45.1MB
-
memory/1324-518-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/1324-525-0x00007FFE2A090000-0x00007FFE2A26B000-memory.dmpFilesize
1.9MB
-
memory/2096-549-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2096-627-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2096-653-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2096-558-0x00007FFE2A090000-0x00007FFE2A26B000-memory.dmpFilesize
1.9MB
-
memory/2112-42-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-964-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-40-0x00000000050B0000-0x000000000599B000-memory.dmpFilesize
8.9MB
-
memory/2112-44-0x0000000003690000-0x0000000003A91000-memory.dmpFilesize
4.0MB
-
memory/2112-161-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-202-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-356-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-97-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-950-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2112-437-0x0000000003690000-0x0000000003A91000-memory.dmpFilesize
4.0MB
-
memory/2200-758-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2200-755-0x00007FFE2A090000-0x00007FFE2A26B000-memory.dmpFilesize
1.9MB
-
memory/2200-769-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2200-704-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/2200-949-0x000000006C4A0000-0x000000006C61B000-memory.dmpFilesize
1.5MB
-
memory/3116-90-0x0000000000860000-0x0000000000960000-memory.dmpFilesize
1024KB
-
memory/3116-92-0x00000000009B0000-0x00000000009D7000-memory.dmpFilesize
156KB
-
memory/3116-93-0x0000000000400000-0x000000000084E000-memory.dmpFilesize
4.3MB
-
memory/3116-100-0x0000000000400000-0x000000000084E000-memory.dmpFilesize
4.3MB
-
memory/3204-975-0x000000006AD40000-0x000000006C0C3000-memory.dmpFilesize
19.5MB
-
memory/3968-162-0x00007FF669560000-0x00007FF66A0C6000-memory.dmpFilesize
11.4MB
-
memory/3968-149-0x00007FF669560000-0x00007FF66A0C6000-memory.dmpFilesize
11.4MB
-
memory/4136-541-0x00007FFE0A8E0000-0x00007FFE0AA4A000-memory.dmpFilesize
1.4MB
-
memory/4136-342-0x0000000000E00000-0x0000000001CDD000-memory.dmpFilesize
14.9MB
-
memory/4136-492-0x00007FFE0A8E0000-0x00007FFE0AA4A000-memory.dmpFilesize
1.4MB
-
memory/4136-440-0x00007FFE0A8E0000-0x00007FFE0AA4A000-memory.dmpFilesize
1.4MB
-
memory/4136-472-0x00007FFE0A8E0000-0x00007FFE0AA4A000-memory.dmpFilesize
1.4MB
-
memory/4136-399-0x00000174A1050000-0x00000174A1051000-memory.dmpFilesize
4KB
-
memory/4328-982-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/4328-486-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/4328-615-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/4328-759-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/4440-173-0x0000000008000000-0x0000000008350000-memory.dmpFilesize
3.3MB
-
memory/4440-155-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/4440-147-0x0000000004EB0000-0x0000000004EE6000-memory.dmpFilesize
216KB
-
memory/4440-179-0x00000000086C0000-0x0000000008736000-memory.dmpFilesize
472KB
-
memory/4440-148-0x0000000007700000-0x0000000007D28000-memory.dmpFilesize
6.2MB
-
memory/4440-214-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4440-150-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4440-154-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/4440-163-0x00000000075F0000-0x0000000007612000-memory.dmpFilesize
136KB
-
memory/4440-177-0x0000000008390000-0x00000000083DB000-memory.dmpFilesize
300KB
-
memory/4440-164-0x0000000007690000-0x00000000076F6000-memory.dmpFilesize
408KB
-
memory/4440-176-0x0000000007DF0000-0x0000000007E0C000-memory.dmpFilesize
112KB
-
memory/4440-165-0x0000000007D30000-0x0000000007D96000-memory.dmpFilesize
408KB
-
memory/4500-987-0x0000000010000000-0x0000000013BC3000-memory.dmpFilesize
59.8MB
-
memory/4576-317-0x000000000A6A0000-0x000000000A6D3000-memory.dmpFilesize
204KB
-
memory/4576-319-0x000000006CCE0000-0x000000006CD2B000-memory.dmpFilesize
300KB
-
memory/4576-196-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/4576-199-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/4576-324-0x000000006CDF0000-0x000000006D140000-memory.dmpFilesize
3.3MB
-
memory/4576-766-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4576-340-0x000000007F6B0000-0x000000007F6C0000-memory.dmpFilesize
64KB
-
memory/4576-244-0x0000000008BE0000-0x0000000008C1C000-memory.dmpFilesize
240KB
-
memory/4576-195-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4628-959-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-102-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-55-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-962-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-953-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-226-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-174-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4628-41-0x00000000036D0000-0x0000000003AD4000-memory.dmpFilesize
4.0MB
-
memory/4628-341-0x00000000036D0000-0x0000000003AD4000-memory.dmpFilesize
4.0MB
-
memory/4628-376-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4728-5-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4728-6-0x0000000005430000-0x0000000005440000-memory.dmpFilesize
64KB
-
memory/4728-4-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/4728-178-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4792-431-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/4792-39-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/4792-38-0x00000000048D0000-0x000000000493D000-memory.dmpFilesize
436KB
-
memory/4792-37-0x0000000002CA0000-0x0000000002DA0000-memory.dmpFilesize
1024KB
-
memory/4792-320-0x0000000002CA0000-0x0000000002DA0000-memory.dmpFilesize
1024KB
-
memory/4792-343-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/4792-94-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB