Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2022, 22:05

General

  • Target

    file.exe

  • Size

    7.3MB

  • MD5

    0a29a0dc7519c70f9496cc9edc42f396

  • SHA1

    d275c7f48a3a9c7e8504280b1e0487bb7c3b5747

  • SHA256

    77d090bfb26e7f9082108a82e3248706f9f2b5a86f96dc0a628495461211555e

  • SHA512

    c7792ab61c37d4e49282ddb2901435cf760c3c91399ef53050323a2500ebd1c6e3c90dfcd138a68dcdefdca499379e72152a7f4331852a3d8d4547b2d25fd82e

  • SSDEEP

    196608:91OJSLWHeQmR7mACiY/jcOcOPosl6xfQvQ:3OJI7mACiG3v6xovQ

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Users\Admin\AppData\Local\Temp\7zSFDFC.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4048
      • C:\Users\Admin\AppData\Local\Temp\7zS7FF.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1652
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1780
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:2896
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:4520
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3516
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4368
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:2248
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:2128
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gayVVjwAq" /SC once /ST 08:17:10 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:1928
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gayVVjwAq"
                  4⤵
                    PID:204
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gayVVjwAq"
                    4⤵
                      PID:2356
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bWLKrWFeqGsUKIPSIT" /SC once /ST 23:07:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\rjhsLhD.exe\" KP /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:4452
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:404
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:3500
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:2336
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:2772
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:3612
                      • C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\rjhsLhD.exe
                        C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\rjhsLhD.exe KP /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:1784
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3152
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5060
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:4320
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:2700
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4976
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:4688
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:4692
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:3168
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:800
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:1808
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:4724
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2628
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:5016
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:4372
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:2932
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:1980
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:4196
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:3344
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:2352
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:1800
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:2304
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:1764
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:5020
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:5024
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:1748
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:316
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SvbbHukzU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\SvbbHukzU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XYDCXZXPsTrrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XYDCXZXPsTrrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dVbwgRbTSJJLORWiduR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dVbwgRbTSJJLORWiduR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nolBHjueEzUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nolBHjueEzUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yOvDRBMJNKKU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yOvDRBMJNKKU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YVKeAuHUOaLCRzVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YVKeAuHUOaLCRzVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\grMXAHIUMHIHAuvw\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\grMXAHIUMHIHAuvw\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1996
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SvbbHukzU" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:3648
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SvbbHukzU" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:4280
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SvbbHukzU" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4168
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XYDCXZXPsTrrC" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:4156
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XYDCXZXPsTrrC" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:684
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dVbwgRbTSJJLORWiduR" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:1812
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dVbwgRbTSJJLORWiduR" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:1816
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nolBHjueEzUn" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:1976
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nolBHjueEzUn" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:3308
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yOvDRBMJNKKU2" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:4348
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yOvDRBMJNKKU2" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4832
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YVKeAuHUOaLCRzVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4572
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YVKeAuHUOaLCRzVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:1752
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:1196
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4472
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\grMXAHIUMHIHAuvw /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4736
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\grMXAHIUMHIHAuvw /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:2552
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gkftsVzJZ" /SC once /ST 07:07:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:2556
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gkftsVzJZ"
                                                                                                            2⤵
                                                                                                              PID:4452
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gkftsVzJZ"
                                                                                                              2⤵
                                                                                                                PID:1420
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "biFxKMwOTZzXEKwTU" /SC once /ST 12:59:37 /RU "SYSTEM" /TR "\"C:\Windows\Temp\grMXAHIUMHIHAuvw\nAUssBiCXSnmAZV\eFmlnQl.exe\" NQ /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:2292
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "biFxKMwOTZzXEKwTU"
                                                                                                                2⤵
                                                                                                                  PID:4396
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4284
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:1428
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:2164
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:3476
                                                                                                                    • C:\Windows\Temp\grMXAHIUMHIHAuvw\nAUssBiCXSnmAZV\eFmlnQl.exe
                                                                                                                      C:\Windows\Temp\grMXAHIUMHIHAuvw\nAUssBiCXSnmAZV\eFmlnQl.exe NQ /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4388
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bWLKrWFeqGsUKIPSIT"
                                                                                                                        2⤵
                                                                                                                          PID:5060
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:4184
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:4016
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:2528
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:4724
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\SvbbHukzU\hIJhvE.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "HvGgydgoxkjNzSQ" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:5068
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "HvGgydgoxkjNzSQ2" /F /xml "C:\Program Files (x86)\SvbbHukzU\FSnEmZP.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1460
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "HvGgydgoxkjNzSQ"
                                                                                                                                  2⤵
                                                                                                                                    PID:776
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "HvGgydgoxkjNzSQ"
                                                                                                                                    2⤵
                                                                                                                                      PID:1688
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "SuOhdtQTTGzWOe" /F /xml "C:\Program Files (x86)\yOvDRBMJNKKU2\HtGLGFQ.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4548
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "wXhUETfkEDyNN2" /F /xml "C:\ProgramData\YVKeAuHUOaLCRzVB\MntzzYJ.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3448
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "gmBhVUxyoAiYAznxf2" /F /xml "C:\Program Files (x86)\dVbwgRbTSJJLORWiduR\afuTILY.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4032
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "ESjeOYxIKdVsIzcFOuL2" /F /xml "C:\Program Files (x86)\XYDCXZXPsTrrC\EmzDSqI.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1312
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "bLgAHCKDimrPMlxXg" /SC once /ST 01:28:38 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\grMXAHIUMHIHAuvw\qGnJVfqS\GRGAgDv.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:684
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "bLgAHCKDimrPMlxXg"
                                                                                                                                      2⤵
                                                                                                                                        PID:1936
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:1752
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:2400
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:2552
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:4164
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "biFxKMwOTZzXEKwTU"
                                                                                                                                                2⤵
                                                                                                                                                  PID:224
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\grMXAHIUMHIHAuvw\qGnJVfqS\GRGAgDv.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:4836
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\grMXAHIUMHIHAuvw\qGnJVfqS\GRGAgDv.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:2212
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "bLgAHCKDimrPMlxXg"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4804

                                                                                                                                                  Network

                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                        Replay Monitor

                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                        Downloads

                                                                                                                                                        • C:\Program Files (x86)\SvbbHukzU\FSnEmZP.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          cff7e99fdb298b59c84ab72b4f59acab

                                                                                                                                                          SHA1

                                                                                                                                                          359211c6bdb2b23c8aee1077b4dfca6ee1284aa0

                                                                                                                                                          SHA256

                                                                                                                                                          ab6b789943fbf121ea5b80f159304198953f56bd870ebc46c9f15f654d1765bb

                                                                                                                                                          SHA512

                                                                                                                                                          5d41a1ce7e8fd42e3c024bb3cc9b2441379c41568a6244b08ccbbbc8f5f12267e2470447dab295bab91318e2db96e8212229fe772b5292b4b7be56195e186951

                                                                                                                                                        • C:\Program Files (x86)\XYDCXZXPsTrrC\EmzDSqI.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          536e02e2d218629a626bc4e3315ba70a

                                                                                                                                                          SHA1

                                                                                                                                                          ff747ff227ad375ece23ee521eb2ec6a7360e217

                                                                                                                                                          SHA256

                                                                                                                                                          29f4f43f36de038b6d4903f7ebd13116a380c13de7215bebd391a98c59349a61

                                                                                                                                                          SHA512

                                                                                                                                                          e2ae8829de4b436f8e14921964b4f9d7915c9a12ff04951e9f887637535ef103ae3a7df7e99238ede89751b06d5aa4522ca00e4e771e7b78f3417f80f13e24b1

                                                                                                                                                        • C:\Program Files (x86)\dVbwgRbTSJJLORWiduR\afuTILY.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          ba33450f293914291cac22854c87db1b

                                                                                                                                                          SHA1

                                                                                                                                                          3dcaf6dc9240559b285720e6e435022a4b3b5349

                                                                                                                                                          SHA256

                                                                                                                                                          6d2bb7b182841338a7c2eda090b78e5854b5666bc5e94e2645388298b7314c92

                                                                                                                                                          SHA512

                                                                                                                                                          bafbd41139845d6b2a4e3c5aacd425d9de59ca6ab39e37bd76c541fd78c5219179d9a385f7cef144d5db61539de5c05282b7e4e102ef5c442ffbe58d188fc88d

                                                                                                                                                        • C:\Program Files (x86)\yOvDRBMJNKKU2\HtGLGFQ.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          d72db60b466651d1b4bc37acd91799fc

                                                                                                                                                          SHA1

                                                                                                                                                          bcbb91196a5fd5146ab2ad51298f9d3c0dfa6dc4

                                                                                                                                                          SHA256

                                                                                                                                                          4a9c3d57d8e2eb9ac6ed6d1356d869fc25b26b0b812c2f77c2dd4dc00c0311a3

                                                                                                                                                          SHA512

                                                                                                                                                          fb5b0019c417625ae4a316b36e42cb34f051afd9bd6fe72097f448da953fbeeed10836ee414d2f93a7b53c65bf590515f37f4b50a1e779b2d7e99bcc9db307a9

                                                                                                                                                        • C:\ProgramData\YVKeAuHUOaLCRzVB\MntzzYJ.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          b2b03d537ee0b4e3751543480baa29d1

                                                                                                                                                          SHA1

                                                                                                                                                          265be2adae465f91009a20a3a82226ae26315f9b

                                                                                                                                                          SHA256

                                                                                                                                                          13eb3ff51647766a3a411a48cdd1f28c3534892f2d1c6ac8d76bedfc3e14822d

                                                                                                                                                          SHA512

                                                                                                                                                          e7b873c3f600b4d01fcb3602ea863369a818f55088c2848870dbb1860dc4878e1d15da06f02a9694fcdc80d547f7ae6b5fa3d8610c883097a0cd5994deb8394e

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                          SHA1

                                                                                                                                                          24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                          SHA256

                                                                                                                                                          b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                          SHA512

                                                                                                                                                          0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                          Filesize

                                                                                                                                                          64B

                                                                                                                                                          MD5

                                                                                                                                                          dbf9fec0284459c885c695c96fdd4e67

                                                                                                                                                          SHA1

                                                                                                                                                          f3530eb549137596bb53cde08a3e3cc1ea237faf

                                                                                                                                                          SHA256

                                                                                                                                                          3cc2ef28f616ca2a6e5fb06da63d6bdb53b63e92701ecee38e84f98b7f56b38a

                                                                                                                                                          SHA512

                                                                                                                                                          95a7858d009940a1c29f9c05c2bd2a6a03a3122fe749546d87e435b5d3172fd0d22dec099b450be3ea99c58b8681484eafd8ad00be1364d9085fc4a9f249f452

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS7FF.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS7FF.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSFDFC.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.3MB

                                                                                                                                                          MD5

                                                                                                                                                          4bfffa8735d78ed8bda1fb092371dbe0

                                                                                                                                                          SHA1

                                                                                                                                                          9228519957b30b93327f023766e013dc64ca23a6

                                                                                                                                                          SHA256

                                                                                                                                                          1d8cb560979c79c00979be625b799a75cc3584f553c2f02e4bb0730fef445b6a

                                                                                                                                                          SHA512

                                                                                                                                                          5e1d98fd2447224da097191bf7be536db3d0ea62e99d91f266a5357420525e72ffd99dd7ea3621fce54a9d3ad26d02cfe0f1643ccde4a8c08478af5fd9f3a4aa

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSFDFC.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.3MB

                                                                                                                                                          MD5

                                                                                                                                                          4bfffa8735d78ed8bda1fb092371dbe0

                                                                                                                                                          SHA1

                                                                                                                                                          9228519957b30b93327f023766e013dc64ca23a6

                                                                                                                                                          SHA256

                                                                                                                                                          1d8cb560979c79c00979be625b799a75cc3584f553c2f02e4bb0730fef445b6a

                                                                                                                                                          SHA512

                                                                                                                                                          5e1d98fd2447224da097191bf7be536db3d0ea62e99d91f266a5357420525e72ffd99dd7ea3621fce54a9d3ad26d02cfe0f1643ccde4a8c08478af5fd9f3a4aa

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\rjhsLhD.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\rjhsLhD.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                          SHA1

                                                                                                                                                          36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                          SHA256

                                                                                                                                                          b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                          SHA512

                                                                                                                                                          676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                          Filesize

                                                                                                                                                          11KB

                                                                                                                                                          MD5

                                                                                                                                                          b71d4c4e1b2d7eb58d8f15dbe2353afa

                                                                                                                                                          SHA1

                                                                                                                                                          cc10b9b89754e901a223bd962c7ffd507ef9c92b

                                                                                                                                                          SHA256

                                                                                                                                                          d87262f6bc8d9b814c2a1c2313f0da7a38a9cbe5e8813e02f83af2f05641e9ab

                                                                                                                                                          SHA512

                                                                                                                                                          bc000b49c1d0bc77eaa5aa68243beeb96b6b56b3982391053bf8fc82db738273cfea3c62c4772c1e37af08959cd56a4145930e093729cd7a4174f7001cfdd7f0

                                                                                                                                                        • C:\Windows\Temp\grMXAHIUMHIHAuvw\nAUssBiCXSnmAZV\eFmlnQl.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Windows\Temp\grMXAHIUMHIHAuvw\nAUssBiCXSnmAZV\eFmlnQl.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.8MB

                                                                                                                                                          MD5

                                                                                                                                                          6772e7af138504e782c6e77d79080a21

                                                                                                                                                          SHA1

                                                                                                                                                          f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                                                                                                          SHA256

                                                                                                                                                          4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                                                                                                          SHA512

                                                                                                                                                          07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                                                                                                        • C:\Windows\Temp\grMXAHIUMHIHAuvw\qGnJVfqS\GRGAgDv.dll

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                          MD5

                                                                                                                                                          b741306fbb35688df1c40ec6572783b7

                                                                                                                                                          SHA1

                                                                                                                                                          4d8f5b3698a82cbb3007ee6a21f3df1de5a24fa7

                                                                                                                                                          SHA256

                                                                                                                                                          fe578f2302cb40e6ba3044239dd2a0c1c722f0a32b68877191dbbb10b798ee41

                                                                                                                                                          SHA512

                                                                                                                                                          6017a55935f1ac4286656a47e55adfd2896a799a436d166e6478921ed0c104caa9edc0e050f313aba544989356a3a91cc08998fc5e91dfd634a0ed419bbab927

                                                                                                                                                        • C:\Windows\Temp\grMXAHIUMHIHAuvw\qGnJVfqS\GRGAgDv.dll

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                          MD5

                                                                                                                                                          b741306fbb35688df1c40ec6572783b7

                                                                                                                                                          SHA1

                                                                                                                                                          4d8f5b3698a82cbb3007ee6a21f3df1de5a24fa7

                                                                                                                                                          SHA256

                                                                                                                                                          fe578f2302cb40e6ba3044239dd2a0c1c722f0a32b68877191dbbb10b798ee41

                                                                                                                                                          SHA512

                                                                                                                                                          6017a55935f1ac4286656a47e55adfd2896a799a436d166e6478921ed0c104caa9edc0e050f313aba544989356a3a91cc08998fc5e91dfd634a0ed419bbab927

                                                                                                                                                        • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          MD5

                                                                                                                                                          279c01cba658fc0ad82f3c201619656c

                                                                                                                                                          SHA1

                                                                                                                                                          d73ebfda7c8708716b10de2819a7fed64a295e60

                                                                                                                                                          SHA256

                                                                                                                                                          ac063b67eaa6a6476ab856e4bd9ff4cf79bbe831880b18eb1cbb34948c7c6cab

                                                                                                                                                          SHA512

                                                                                                                                                          cf385228df756d6fc05a52e8883e89df71dc91434255143a200d9ed5eba13ce8a3635bc82991ea38bd35531056b3d286be785b451dab638b18293477f7542a55

                                                                                                                                                        • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                          Filesize

                                                                                                                                                          268B

                                                                                                                                                          MD5

                                                                                                                                                          a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                          SHA1

                                                                                                                                                          1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                          SHA256

                                                                                                                                                          9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                          SHA512

                                                                                                                                                          9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                        • memory/404-154-0x00007FF9F3A50000-0x00007FF9F4511000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                        • memory/404-152-0x00007FF9F3A50000-0x00007FF9F4511000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                        • memory/404-151-0x000001EA45C10000-0x000001EA45C32000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          136KB

                                                                                                                                                        • memory/2212-252-0x0000000010640000-0x0000000011640000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          16.0MB

                                                                                                                                                        • memory/2820-138-0x0000000010000000-0x0000000011000000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          16.0MB

                                                                                                                                                        • memory/3152-164-0x0000000003C90000-0x00000000042B8000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                        • memory/3152-165-0x0000000003B40000-0x0000000003B62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          136KB

                                                                                                                                                        • memory/3152-166-0x0000000004330000-0x0000000004396000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          408KB

                                                                                                                                                        • memory/3152-167-0x00000000043A0000-0x0000000004406000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          408KB

                                                                                                                                                        • memory/3152-168-0x0000000004AE0000-0x0000000004AFE000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          120KB

                                                                                                                                                        • memory/3152-163-0x0000000003520000-0x0000000003556000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          216KB

                                                                                                                                                        • memory/4284-221-0x00007FF9F2790000-0x00007FF9F3251000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                        • memory/4284-219-0x00007FF9F2790000-0x00007FF9F3251000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                        • memory/4388-246-0x00000000055F0000-0x00000000056AF000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          764KB

                                                                                                                                                        • memory/4388-243-0x00000000053B0000-0x0000000005423000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          460KB

                                                                                                                                                        • memory/4388-229-0x00000000043F0000-0x0000000004475000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          532KB

                                                                                                                                                        • memory/4388-233-0x0000000004A40000-0x0000000004AA5000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          404KB